{"resultsPerPage":1524,"startIndex":0,"totalResults":1524,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-24T23:05:09.872","vulnerabilities":[{"cve":{"id":"CVE-2026-82370","sourceIdentifier":"sirt@brocade.com","published":"2026-09-24T00:17:21.777","lastModified":"2026-10-01T21:17:25.110","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch configurations or manipulate application container runtimes. This vulnerability affects Brocade SANnav versions before 3.0.1a."}],"affected":[{"source":"sirt@brocade.com","affectedData":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"affected","versions":[{"version":"0","lessThan":"3.0.1a","versionType":"Brocade SANnav","status":"affected","changes":[{"at":"3.0.1a","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"sirt@brocade.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-82370","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sirt@brocade.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38995","source":"sirt@brocade.com"}]}},{"cve":{"id":"CVE-2026-89078","sourceIdentifier":"cve@gitlab.com","published":"2026-09-24T00:17:22.060","lastModified":"2026-09-28T15:22:58.227","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"19.2","lessThan":"19.2.7","versionType":"semver","status":"affected"},{"version":"19.3","lessThan":"19.3.3","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-89078","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-415"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.2.0","versionEndExcluding":"19.2.7","matchCriteriaId":"2E337204-7AC0-4D9A-ADE3-D435F0E8F4CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.2.0","versionEndExcluding":"19.2.7","matchCriteriaId":"501CC95C-E50C-47C8-A7E0-68B106B22291"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"053EF913-CD59-404C-8878-B42B122608DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"FDD16091-261D-4616-BF85-70CF011C6740"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:community:*:*:*","matchCriteriaId":"476CE485-460C-4EBE-AC16-D7AE6C30DF50"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"DED8DBAE-9FCD-40A4-9A9B-BAC26B4CBD44"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/628577","source":"cve@gitlab.com","tags":["Issue Tracking"]},{"url":"https://hackerone.com/reports/4019059","source":"cve@gitlab.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-92470","sourceIdentifier":"cve@gitlab.com","published":"2026-09-24T00:17:22.193","lastModified":"2026-09-28T19:00:29.650","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"18.7","lessThan":"19.2.7","versionType":"semver","status":"affected"},{"version":"19.3","lessThan":"19.3.3","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:38:36.502715Z","id":"CVE-2026-92470","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"18.7.0","versionEndExcluding":"19.2.7","matchCriteriaId":"300491B5-6ECF-46CB-A6F1-69E0FB52153B"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"FDD16091-261D-4616-BF85-70CF011C6740"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"DED8DBAE-9FCD-40A4-9A9B-BAC26B4CBD44"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/617719","source":"cve@gitlab.com","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-92529","sourceIdentifier":"cve@gitlab.com","published":"2026-09-24T00:17:22.323","lastModified":"2026-09-28T18:59:10.517","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls for workflows in namespaces they do not control due to improper authorization checks."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"19.1","lessThan":"19.2.7","versionType":"semver","status":"affected"},{"version":"19.3","lessThan":"19.3.3","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:05:48.675021Z","id":"CVE-2026-92529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.1.0","versionEndExcluding":"19.2.7","matchCriteriaId":"B80C4185-9A73-4866-A169-F4B2F6BA048C"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"FDD16091-261D-4616-BF85-70CF011C6740"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"DED8DBAE-9FCD-40A4-9A9B-BAC26B4CBD44"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/605431","source":"cve@gitlab.com","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-92530","sourceIdentifier":"cve@gitlab.com","published":"2026-09-24T00:17:22.453","lastModified":"2026-09-28T18:58:24.633","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on the target instance due to improper reliance on ephemeral cache state during Direct Transfer imports."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"19.1","lessThan":"19.2.7","versionType":"semver","status":"affected"},{"version":"19.3","lessThan":"19.3.3","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:24:28.742595Z","id":"CVE-2026-92530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-348"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.1.0","versionEndExcluding":"19.2.7","matchCriteriaId":"1B63D592-2D43-4407-8747-B6E2C1059588"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.1.0","versionEndExcluding":"19.2.7","matchCriteriaId":"B80C4185-9A73-4866-A169-F4B2F6BA048C"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"053EF913-CD59-404C-8878-B42B122608DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"FDD16091-261D-4616-BF85-70CF011C6740"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:community:*:*:*","matchCriteriaId":"476CE485-460C-4EBE-AC16-D7AE6C30DF50"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"DED8DBAE-9FCD-40A4-9A9B-BAC26B4CBD44"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/628379","source":"cve@gitlab.com","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-92628","sourceIdentifier":"cve@gitlab.com","published":"2026-09-24T00:17:22.583","lastModified":"2026-09-28T15:22:49.920","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"18.6","lessThan":"19.2.7","versionType":"semver","status":"affected"},{"version":"19.3","lessThan":"19.3.3","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:10:16.617570Z","id":"CVE-2026-92628","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"18.6.0","versionEndExcluding":"19.2.7","matchCriteriaId":"CB03812E-36B6-4052-B376-6E3D3CE2B86C"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"18.6.0","versionEndExcluding":"19.2.7","matchCriteriaId":"216C90EC-E653-45F2-A838-B10DD81BDA6A"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"053EF913-CD59-404C-8878-B42B122608DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"FDD16091-261D-4616-BF85-70CF011C6740"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:community:*:*:*","matchCriteriaId":"476CE485-460C-4EBE-AC16-D7AE6C30DF50"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"DED8DBAE-9FCD-40A4-9A9B-BAC26B4CBD44"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/621933","source":"cve@gitlab.com","tags":["Issue Tracking"]}]}},{"cve":{"id":"CVE-2026-92874","sourceIdentifier":"cve@gitlab.com","published":"2026-09-24T00:17:22.713","lastModified":"2026-09-28T15:22:41.523","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with an MCP-scoped token to perform actions beyond the intended scope of that token due to improper authorization checks."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"18.3","lessThan":"19.2.7","versionType":"semver","status":"affected"},{"version":"19.3","lessThan":"19.3.3","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:09:38.009631Z","id":"CVE-2026-92874","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"18.3.0","versionEndExcluding":"19.2.7","matchCriteriaId":"D2DF7E33-826B-462B-A28D-0A12456E71AF"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"18.3.0","versionEndExcluding":"19.2.7","matchCriteriaId":"450D3E8E-881E-4DC6-8519-A47C34D1D556"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"053EF913-CD59-404C-8878-B42B122608DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"FDD16091-261D-4616-BF85-70CF011C6740"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:community:*:*:*","matchCriteriaId":"476CE485-460C-4EBE-AC16-D7AE6C30DF50"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"DED8DBAE-9FCD-40A4-9A9B-BAC26B4CBD44"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/618614","source":"cve@gitlab.com","tags":["Issue Tracking"]}]}},{"cve":{"id":"CVE-2026-93577","sourceIdentifier":"cve@gitlab.com","published":"2026-09-24T00:17:22.850","lastModified":"2026-09-28T15:22:15.293","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"19.2","lessThan":"19.2.7","versionType":"semver","status":"affected"},{"version":"19.3","lessThan":"19.3.3","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-93577","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.2.0","versionEndExcluding":"19.2.7","matchCriteriaId":"2E337204-7AC0-4D9A-ADE3-D435F0E8F4CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.2.0","versionEndExcluding":"19.2.7","matchCriteriaId":"501CC95C-E50C-47C8-A7E0-68B106B22291"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"053EF913-CD59-404C-8878-B42B122608DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"FDD16091-261D-4616-BF85-70CF011C6740"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:community:*:*:*","matchCriteriaId":"476CE485-460C-4EBE-AC16-D7AE6C30DF50"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"DED8DBAE-9FCD-40A4-9A9B-BAC26B4CBD44"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/629758","source":"cve@gitlab.com","tags":["Issue Tracking"]},{"url":"https://hackerone.com/reports/3995696","source":"cve@gitlab.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-96739","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T00:17:22.990","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/upload_json.php of the component KindEditor Upload Interface. This manipulation of the argument imgFile causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"SEMCMS","cpes":["cpe:2.3:a:semcms:semcms:*:*:*:*:*:*:*:*"],"modules":["KindEditor Upload Interface"],"versions":[{"version":"4.0","status":"affected"},{"version":"4.1","status":"affected"},{"version":"4.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:36:04.254916Z","id":"CVE-2026-96739","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/CSDVi/cve/issues/7","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96739","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904124","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409004","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409004/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96751","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T00:17:23.170","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/add_project.php. Such manipulation of the argument conn_settings leads to sql injection. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"pmTicket","product":"Project-Management-Software","cpes":["cpe:2.3:a:pmticket:project-management-software:*:*:*:*:*:*:*:*"],"versions":[{"version":"078fa56a782490c5059a0814f84df27984f4d7e2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:18:49.958274Z","id":"CVE-2026-96751","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://asciinema.org/a/1230576","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96751","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904342","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409005","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409005/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96762","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T00:17:23.353","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"kvcache-ai","product":"mooncake","cpes":["cpe:2.3:a:kvcache-ai:mooncake:*:*:*:*:*:*:*:*"],"modules":["RPC Path Handler"],"versions":[{"version":"0.3.0","status":"affected"},{"version":"0.3.1","status":"affected"},{"version":"0.3.2","status":"affected"},{"version":"0.3.3","status":"affected"},{"version":"0.3.4","status":"affected"},{"version":"0.3.5","status":"affected"},{"version":"0.3.6","status":"affected"},{"version":"0.3.7","status":"affected"},{"version":"0.3.8","status":"affected"},{"version":"0.3.9","status":"affected"},{"version":"0.3.10","status":"affected"},{"version":"0.3.11","status":"affected"},{"version":"0.3.12","status":"affected"},{"version":"0.3.13.post1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:17:42.616673Z","id":"CVE-2026-96762","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://gist.github.com/yyymk/76d099537af0e661dd01eacc82b9a7ea","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96762","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904600","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409016","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409016/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96763","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T01:16:59.627","lastModified":"2026-09-29T03:17:22.323","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"kvcache-ai","product":"mooncake","cpes":["cpe:2.3:a:kvcache-ai:mooncake:*:*:*:*:*:*:*:*"],"modules":["MountSegment Request Processing"],"versions":[{"version":"0.3.0","status":"affected"},{"version":"0.3.1","status":"affected"},{"version":"0.3.2","status":"affected"},{"version":"0.3.3","status":"affected"},{"version":"0.3.4","status":"affected"},{"version":"0.3.5","status":"affected"},{"version":"0.3.6","status":"affected"},{"version":"0.3.7","status":"affected"},{"version":"0.3.8","status":"affected"},{"version":"0.3.9","status":"affected"},{"version":"0.3.10","status":"affected"},{"version":"0.3.11","status":"affected"},{"version":"0.3.12","status":"affected"},{"version":"0.3.13.post1","status":"affected"},{"version":"0.3.14-rc1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:41:13.416455Z","id":"CVE-2026-96763","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://gist.github.com/yyymk/fea24846dc31042cb472d7bd496a8438","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96763","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904605","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409018","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409018/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96764","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T01:16:59.813","lastModified":"2026-09-24T15:18:00.490","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex of the component Regular Expression Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"kvcache-ai","product":"mooncake","cpes":["cpe:2.3:a:kvcache-ai:mooncake:*:*:*:*:*:*:*:*"],"modules":["Regular Expression Handler"],"versions":[{"version":"0.3.0","status":"affected"},{"version":"0.3.1","status":"affected"},{"version":"0.3.2","status":"affected"},{"version":"0.3.3","status":"affected"},{"version":"0.3.4","status":"affected"},{"version":"0.3.5","status":"affected"},{"version":"0.3.6","status":"affected"},{"version":"0.3.7","status":"affected"},{"version":"0.3.8","status":"affected"},{"version":"0.3.9","status":"affected"},{"version":"0.3.10","status":"affected"},{"version":"0.3.11","status":"affected"},{"version":"0.3.12","status":"affected"},{"version":"0.3.14-rc1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:33:17.401895Z","id":"CVE-2026-96764","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://gist.github.com/yyymk/4699cc95ab9a559ee15a0fb798bd6c5d","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96764","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904607","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409019","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409019/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96772","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T01:17:00.010","lastModified":"2026-09-24T16:17:27.760","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Intelliants","product":"Subrion CMS","cpes":["cpe:2.3:a:intelliants:subrion_cms:*:*:*:*:*:*:*:*"],"versions":[{"version":"4.2.0","status":"affected"},{"version":"4.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:35:45.508683Z","id":"CVE-2026-96772","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/volksec/SubrionCMS-Security-Advisories/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96772","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904804","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409027","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409027/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96773","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T01:17:00.207","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $_SERVER['HTTP_REFERER'] causes open redirect. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Intelliants","product":"Subrion CMS","cpes":["cpe:2.3:a:intelliants:subrion_cms:*:*:*:*:*:*:*:*"],"modules":["Login Page"],"versions":[{"version":"4.2.0","status":"affected"},{"version":"4.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:17:08.186448Z","id":"CVE-2026-96773","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://github.com/volksec/SubrionCMS-Security-Advisories/issues/2","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96773","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904805","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409028","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409028/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96774","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T01:17:00.387","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. This affects the function loadCfg of the file /ini/sys_cfg.txt of the component Configuration File Download. The manipulation results in information disclosure. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SPON Communications","product":"IP Network Audio Device XC-9603","cpes":["cpe:2.3:a:spon_communications:ip_network_audio_device_xc-9603:*:*:*:*:*:*:*:*"],"modules":["Configuration File Download"],"versions":[{"version":"1.2.3_20181106 Build 107","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:16:31.291933Z","id":"CVE-2026-96774","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-96774","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904898","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409033","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409033/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-18467","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T02:16:52.943","lastModified":"2026-09-24T16:17:07.393","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wp_hash()/hash_equals() signature gate on the pt-paytium-user-data field, but left a second filter — pt_cf_checkout_meta(), registered on the pt_meta_values hook after the signed builder — that copies every $_POST['pt_form_field'][*] key verbatim into the payment meta array without any signature verification; this allows the pt-user-role value it copies to overwrite the signed path's output, after which paytium_user_data_processing() reads the persisted _pt-user-role post meta and passes it directly as the role argument to wp_insert_user(). This makes it possible for unauthenticated attackers to register a new WordPress account with the administrator role and fully take over the site. Exploitation requires submitting a payment through a publicly-exposed [paytium] shortcode form and completing the resulting payment flow, after which the attacker can seize the new administrator account via the standard lost-password flow on their supplied email address."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"paytiumsupport","product":"Paytium: Mollie payment forms & donations","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:38:06.322433Z","id":"CVE-2026-18467","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/paytium/tags/5.0.3/includes/payment-functions.php#L113","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/paytium/tags/5.0.3/includes/process-payment-functions.php#L1103","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/paytium/tags/5.0.3/includes/process-payment-functions.php#L21","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/paytium/tags/5.0.3/includes/process-payment-functions.php#L696","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/paytium/tags/5.0.3/includes/user-data-functions.php#L214","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3678569/paytium","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caa1a42a-6bb2-42c8-aae7-fb1c895573a8?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96777","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T02:16:53.563","lastModified":"2026-09-29T03:17:22.477","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulation of the argument Name causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Forma","product":"LMS","cpes":["cpe:2.3:a:forma:lms:*:*:*:*:*:*:*:*"],"modules":["Multi-User-Selector AJAX Endpoint"],"versions":[{"version":"4.1.0","status":"affected"},{"version":"4.1.1","status":"affected"},{"version":"4.1.2","status":"affected"},{"version":"4.1.3","status":"affected"},{"version":"4.1.4","status":"affected"},{"version":"4.1.5","status":"affected"},{"version":"4.1.6","status":"affected"},{"version":"4.1.7","status":"affected"},{"version":"4.1.8","status":"affected"},{"version":"4.1.9","status":"affected"},{"version":"4.1.10","status":"affected"},{"version":"4.1.11","status":"affected"},{"version":"4.1.12","status":"affected"},{"version":"4.1.13","status":"affected"},{"version":"4.1.14","status":"affected"},{"version":"4.1.15","status":"affected"},{"version":"4.1.16","status":"affected"},{"version":"4.1.17","status":"affected"},{"version":"4.1.18","status":"affected"},{"version":"4.1.19","status":"affected"},{"version":"4.1.20","status":"affected"},{"version":"4.1.21","status":"affected"},{"version":"4.1.22","status":"affected"},{"version":"4.1.23","status":"affected"},{"version":"4.1.24","status":"affected"},{"version":"4.1.25","status":"affected"},{"version":"4.1.26","status":"affected"},{"version":"4.1.27","status":"affected"},{"version":"4.1.28","status":"affected"},{"version":"4.1.29","status":"affected"},{"version":"4.1.30","status":"affected"},{"version":"4.1.31","status":"affected"},{"version":"4.1.32","status":"affected"},{"version":"4.1.33","status":"affected"},{"version":"4.1.34","status":"affected"},{"version":"4.1.35","status":"affected"},{"version":"4.1.36","status":"affected"},{"version":"4.1.37","status":"affected"},{"version":"4.1.38","status":"affected"},{"version":"4.1.39","status":"affected"},{"version":"4.1.40","status":"affected"},{"version":"4.1.41","status":"affected"},{"version":"4.1.42","status":"affected"},{"version":"4.1.43","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:42:12.781448Z","id":"CVE-2026-96777","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/lorenzobruno7/advisory_formalms/tree/main","source":"cna@vuldb.com"},{"url":"https://github.com/lorenzobruno7/advisory_formalms_sql/tree/main","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96777","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/905111","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409034","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409034/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96803","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T02:16:53.770","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in java110 MicroCommunity up to 2.0. Affected is the function QueryServiceSMOImpl.fallBack of the file BusinessApi.java of the component fallBack API Endpoint. Such manipulation of the argument fallBackSql leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"java110","product":"MicroCommunity","cpes":["cpe:2.3:a:java110:microcommunity:*:*:*:*:*:*:*:*"],"modules":["fallBack API Endpoint"],"versions":[{"version":"2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:03:35.552310Z","id":"CVE-2026-96803","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://gitee.com/yhx070424/MicroCommunity/issues/IK4014","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96803","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/905472","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409035","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409035/cti","source":"cna@vuldb.com"},{"url":"https://gitee.com/yhx070424/MicroCommunity/issues/IK4014","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96810","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T02:16:53.960","lastModified":"2026-09-24T16:17:27.900","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in huanzi-qch base-admin up to 52816b760cd53244989fd664bbb2b3d4edbfdbf1. This issue affects the function Save of the file base-admin-master\\src\\main\\java\\cn\\huanzi\\qch\\baseadmin\\common\\controller\\CommonController.java of the component Add User Handler. The manipulation of the argument Username leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"huanzi-qch","product":"base-admin","cpes":["cpe:2.3:a:huanzi-qch:base-admin:*:*:*:*:*:*:*:*"],"modules":["Add User Handler"],"versions":[{"version":"52816b760cd53244989fd664bbb2b3d4edbfdbf1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:32:39.772615Z","id":"CVE-2026-96810","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/jac40577-art/cve-db/blob/master/BaseAdminSystem%20-%20Introduction_to_Storage-Based_XSS_Vulnerability.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96810","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/905724","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409062","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409062/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96880","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T02:16:54.147","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"TaleLin","product":"lin-cms-spring-boot","cpes":["cpe:2.3:a:talelin:lin-cms-spring-boot:*:*:*:*:*:*:*:*"],"modules":["book Endpoint"],"versions":[{"version":"0.2.0","status":"affected"},{"version":"0.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:51:20.977235Z","id":"CVE-2026-96880","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/hhhh333/CVE/blob/main/Lin-CMS-%E6%9C%AA%E6%8E%88%E6%9D%83.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96880","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/906081","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409078","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409078/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97055","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T02:16:54.333","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or the deprecated SIGNOZ_JWT_SECRET) to an empty string, and Config.Validate() does not reject the empty value, so a deployment that does not configure a secret starts up and both signs and verifies session tokens with an empty HMAC key. Because the JWT tokenizer was the default provider, any such deployment is affected. An unauthenticated attacker who knows the ID of an existing user can forge a valid session token for that user — including an administrator — by signing the id, orgId and email claims with an empty key; the organization ID (and whether an email is registered) can be obtained without authentication from /api/v2/sessions/context. A forged refresh token can be exchanged at /api/v2/sessions/rotate for a new token pair and cannot be revoked, so it remains usable for its full lifetime (30 days by default). Fixed in v0.143.0, which requires a JWT secret when the jwt provider is selected and changes the default provider to opaque."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"SigNoz","product":"signoz","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/SigNoz/signoz","versions":[{"version":"0.8.0","lessThan":"0.143.0","versionType":"semver","status":"affected"},{"version":"0.143.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:57:48.983290Z","id":"CVE-2026-97055","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1188"}]}],"references":[{"url":"https://github.com/SigNoz/signoz/commit/67895d366d","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/commit/b02aae2db3","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/security/advisories/GHSA-c26w-g4j8-39m2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/signoz-before-0.143.0-authentication-bypass-via-empty-jwt-secret","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/security/advisories/GHSA-c26w-g4j8-39m2","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97056","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T02:16:54.500","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user's existing login sessions when the user's password is reset with a reset token (UpdatePasswordByResetPasswordToken, reachable via POST /api/v2/factor_password/reset) or when the user is deleted (DeleteUser, reachable via DELETE /api/v2/users/{id}). Neither code path calls the tokenizer's DeleteTokensByUserID, so cached tokens and identities are left in place. An attacker who already holds a session token for the account — for example from a stolen browser session or from a user being offboarded — retains the account's full access, up to administrator, after a password reset until the token reaches its configured maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default). This defeats password reset and user deletion as a means of terminating access. The issue is fixed in v0.143.0."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"SigNoz","product":"signoz","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/SigNoz/signoz","versions":[{"version":"0.98.0","lessThan":"0.143.0","versionType":"semver","status":"affected"},{"version":"0.143.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:55:59.241523Z","id":"CVE-2026-97056","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://github.com/SigNoz/signoz/commit/b02aae2db3","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/commit/c122bc09b4","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/commit/e2e9173986","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/commit/faaed20dbd","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/security/advisories/GHSA-xrgp-3fq4-xg83","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/signoz-before-0.143.0-insufficient-session-expiration-authentication-bypass","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/security/advisories/GHSA-xrgp-3fq4-xg83","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96881","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T03:16:58.333","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. Affected is the function getBooks of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"TaleLin","product":"lin-cms-spring-boot","cpes":["cpe:2.3:a:talelin:lin-cms-spring-boot:*:*:*:*:*:*:*:*"],"modules":["book Endpoint"],"versions":[{"version":"0.2.0","status":"affected"},{"version":"0.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:04:31.016000Z","id":"CVE-2026-96881","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/hhhh333/CVE/blob/main/Lin-CMS-%E6%9C%AA%E6%8E%88%E6%9D%832.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96881","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/906082","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409079","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409079/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96882","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T03:16:58.577","lastModified":"2026-09-29T03:17:22.647","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"TaleLin","product":"lin-cms-spring-boot","cpes":["cpe:2.3:a:talelin:lin-cms-spring-boot:*:*:*:*:*:*:*:*"],"modules":["book Endpoint"],"versions":[{"version":"0.2.0","status":"affected"},{"version":"0.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:43:35.907412Z","id":"CVE-2026-96882","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/hhhh333/CVE/blob/main/Lin-CMS-%E6%9C%AA%E6%8E%88%E6%9D%833.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96882","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/906083","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409080","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409080/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96884","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T03:16:58.760","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.cs of the component Preview. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"MantisZip","cpes":["cpe:2.3:a:mantiszip:mantiszip:*:*:*:*:*:*:*:*"],"modules":["Preview"],"versions":[{"version":"0.4.0","status":"affected"},{"version":"0.4.1","status":"affected"},{"version":"0.4.2","status":"affected"},{"version":"0.4.3","status":"affected"},{"version":"0.4.4","status":"affected"},{"version":"0.4.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:50:24.692997Z","id":"CVE-2026-96884","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://gitee.com/yhx070424/MantisZip/issues/IK4AHB","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96884","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/906093","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409081","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409081/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96891","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T03:16:58.950","lastModified":"2026-09-24T16:17:28.193","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of the argument peer_hostname  leads to out-of-bounds write. The attack may be initiated remotely."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"D-Link","product":"DIR-825","cpes":["cpe:2.3:h:d-link:dir-825:*:*:*:*:*:*:*:*"],"modules":["rp-l2tp"],"versions":[{"version":"3.00b32","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:32:03.699556Z","id":"CVE-2026-96891","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://tzh00203.notion.site/D-Link-DIR-825-L2TP-Host-Name-AVP-Out-of-Bounds-Write-33cb5c52018a80458ffec58b62096940","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96891","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/906301","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409134","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409134/cti","source":"cna@vuldb.com"},{"url":"https://www.dlink.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97149","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T03:16:59.133","lastModified":"2026-10-06T18:16:59.117","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. An attacker holding a PUT TempURL for a single object can add an X-Copy-From header naming any object in the same account; the copy middleware copies that object to the destination, and the attacker then reads the victim's data back with a GET TempURL for the destination object. Copies across account boundaries are rejected. Only deployments using the shipped default proxy pipeline (tempurl and copy middleware) with account-level TempURL keys are affected."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"OpenStack","product":"Swift","defaultStatus":"unaffected","repo":"https://opendev.org/openstack/swift","versions":[{"version":"2.4.0","lessThan":"2.35.5","versionType":"semver","status":"affected"},{"version":"2.36.0","lessThan":"2.36.4","versionType":"semver","status":"affected"},{"version":"2.37.0","lessThan":"2.37.4","versionType":"semver","status":"affected"},{"version":"2.38.0","lessThan":"2.38.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:53:29.868605Z","id":"CVE-2026-97149","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-184"}]}],"references":[{"url":"https://launchpad.net/bugs/2166876","source":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/5","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-96892","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T04:18:04.790","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument submit-url can lead to open redirect. The attack may be launched remotely. The exploit has been published and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Edimax","product":"BR-6428nC","cpes":["cpe:2.3:a:edimax:br-6428nc:*:*:*:*:*:*:*:*"],"modules":["goform Handler"],"versions":[{"version":"1.16","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:48:59.165927Z","id":"CVE-2026-96892","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://tzh00203.notion.site/Edimax-BR-6428nC-Open-Redirect-via-submit-url-33db5c52018a808a8c34c1cb68db7aab","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96892","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/906338","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409175","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409175/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96898","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T04:18:05.833","lastModified":"2026-09-24T16:17:28.330","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument path_type results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"yhx070424","product":"ShopXO","cpes":["cpe:2.3:a:shopxo:shopxo:*:*:*:*:*:*:*:*"],"modules":["Ueditor Upload Interface"],"versions":[{"version":"2.2.0","status":"affected"},{"version":"2.2.1","status":"affected"},{"version":"2.2.2","status":"affected"},{"version":"2.2.3","status":"affected"},{"version":"2.2.4","status":"affected"},{"version":"2.2.5","status":"affected"},{"version":"2.2.6","status":"affected"},{"version":"2.2.7","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:17:23.756599Z","id":"CVE-2026-96898","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://gitee.com/yhx070424/shopxo/","source":"cna@vuldb.com"},{"url":"https://gitee.com/yhx070424/shopxo/issues/IK4LPH","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96898","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/906413","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409201","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409201/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97151","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T04:18:06.027","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"mwilliamson","product":"mammoth.js","defaultStatus":"unaffected","collectionURL":"https://registry.npmjs.org","packageName":"mammoth","modules":["docx styles reader"],"programFiles":["lib/docx/styles-reader.js"],"programRoutines":[{"name":"readStylesXml"}],"repo":"https://github.com/mwilliamson/mammoth.js","packageURL":"pkg:npm/mammoth","versions":[{"version":"0","lessThan":"1.12.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:02:06.758652Z","id":"CVE-2026-97151","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-1321"}]}],"references":[{"url":"https://github.com/mwilliamson/mammoth.js/commit/2888fa158d67c1419199f152326e12a05618b53e","source":"cve@mitre.org"},{"url":"https://github.com/mwilliamson/mammoth.js/commit/31f0c370be4b95ac4fa285fea3be970606735f16","source":"cve@mitre.org"},{"url":"https://raw.githubusercontent.com/mwilliamson/mammoth.js/master/NEWS","source":"cve@mitre.org"},{"url":"https://www.npmjs.com/package/mammoth","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-97152","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T04:18:06.213","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Version header, through snprintf."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Nanomsg","product":"Nanomsg","defaultStatus":"unaffected","modules":["websocket"],"programFiles":["ws_handshake.c"],"repo":"https://github.com/nanomsg/nanomsg","versions":[{"version":"0.5.0","lessThan":"1.2.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:46:52.122399Z","id":"CVE-2026-97152","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://github.com/nanomsg/nanomsg/pull/1130","source":"cve@mitre.org"},{"url":"https://github.com/nanomsg/nanomsg/releases/tag/1.2.3","source":"cve@mitre.org"},{"url":"https://nanomsg.org","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-97155","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T04:18:06.397","lastModified":"2026-09-26T23:16:42.507","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empty by default, resulting in all domains being trusted. As a consequence, any website visited by a user with the Folio Client and browser extension installed could invoke client functions, e.g., related to downloading documents, opening documents, and synchronizing files. The first fixed builds are Fabasoft Folio Client 2026 (Build 26.0.0.10) and Fabasoft Folio Client 2026 April Release (Build 26.4.0.76). This client is, for example, shipped with Fabasoft eGov-Suite."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Fabasoft","product":"Folio Client","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2026","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:39:42.994451Z","id":"CVE-2026-97155","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"references":[{"url":"https://help.supportservices.fabasoft.com/index.php?topic=doc/Knowledge-Base/changes-to-fabasoft-folio-client-security-settings.htm","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-14780","sourceIdentifier":"eb41dac7-0af8-4f84-9f6d-0272772514f4","published":"2026-09-24T06:17:00.567","lastModified":"2026-10-13T05:16:32.177","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox.  \n\nA successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system."}],"affected":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","affectedData":[{"vendor":"PaperCut","product":"PaperCut NG/MF","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"24.1.11","versionType":"semver","status":"affected"},{"version":"25.0.0","lessThan":"25.0.12","versionType":"semver","status":"affected"},{"version":"26.0.0","lessThan":"26.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-14780","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://www.papercut.com/kb/Main/security-bulletin-sep-2026/","source":"eb41dac7-0af8-4f84-9f6d-0272772514f4"}]}},{"cve":{"id":"CVE-2026-74991","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:00.943","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WPForms  WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other applications on the site owner's Stripe account."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WPForms","defaultStatus":"unaffected","versions":[{"version":"1.8.8.2","lessThan":"2.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:37:40.135706Z","id":"CVE-2026-74991","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/e539d37e-91bb-4d79-b812-ac3c6c1a0f70/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-80338","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:01.317","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline.\nExploitation requires the site's  or another CMB2 WordPress plugin before 2.13.0 to have declared an oEmbed field, as the CMB2 WordPress plugin before 2.13.0 registers none of its own. The stored value is never attacker-controlled, so the issue does not lead to privilege escalation."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"CMB2","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.13.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:37:26.261371Z","id":"CVE-2026-80338","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/7402e0b0-54de-42b3-9032-ae225fb4e76a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-80513","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:01.430","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object.\nNo POP chain is present in the wpForo Forum WordPress plugin before 3.1.6 itself; if one is present via another installed wpForo Forum WordPress plugin before 3.1.6 or , this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"wpForo Forum","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.1.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:37:15.714540Z","id":"CVE-2026-80513","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://wpscan.com/vulnerability/09c9b9e7-c178-4f05-80d8-d4d77b7c5050/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-82195","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:01.540","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The 10Web Booster  WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"10Web Booster","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.34.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:36:40.745716Z","id":"CVE-2026-82195","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/c6e4763e-e4db-4318-9631-06ee7426f3ae/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-82849","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:01.650","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Masteriyo LMS  WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is skipped whenever the requested account is not named with a non-zero value, in which case the records of every learner on the site are returned at once."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Masteriyo LMS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.4.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:35:56.760373Z","id":"CVE-2026-82849","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/8114501a-3591-4d8c-b73e-a598756d45d7/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-82850","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:01.770","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Masteriyo LMS  WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is applied only to a fixed list of question types, so the answers to every other type are returned in full to anyone able to view the questions."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Masteriyo LMS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.4.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:35:39.734415Z","id":"CVE-2026-82850","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b26150aa-9220-4eb3-a160-0f5301faacc7/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84151","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:01.873","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Post Grid  WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leading to HTML injection (phishing frames, CSS defacement and spoofed input forms) that renders to any visitor and to administrators reviewing the content."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"The Post Grid","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"7.9.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:35:16.466485Z","id":"CVE-2026-84151","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/6601a305-a76f-40fe-8d78-c6a33a66d5f3/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88843","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.207","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"3.5.29","lessThan":"3.7.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:35:02.540672Z","id":"CVE-2026-88843","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://wpscan.com/vulnerability/fffc0d8c-256e-417d-b76c-251948b9f1ed/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88845","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.313","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"2.3.0","lessThan":"3.7.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:34:49.841707Z","id":"CVE-2026-88845","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/a1693fd3-7ba9-4a59-99ea-7f9fd00a9de1/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88846","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.437","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"2.3.0","lessThan":"3.7.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:34:39.104982Z","id":"CVE-2026-88846","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/57b0dd3f-bd83-4fb7-b98d-c999026910cd/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88847","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.533","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.7.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:34:24.594406Z","id":"CVE-2026-88847","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/c42e9b3a-5a0d-4e16-b18a-4184c09bcb5a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-89002","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.633","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review the campaign."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WPeMatico RSS Feed Fetcher","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.8.26","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:34:14.011197Z","id":"CVE-2026-89002","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/6820fac6-3238-4470-a865-677c4442f658/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-89004","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.740","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by other users, including administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WPeMatico RSS Feed Fetcher","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.8.26","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:34:02.613602Z","id":"CVE-2026-89004","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/1568f9e4-defe-423a-a631-e0afd829b972/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-89005","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.843","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session of any higher-privileged user who later views the campaign."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WPeMatico RSS Feed Fetcher","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.8.26","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:33:48.662810Z","id":"CVE-2026-89005","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/1c6f4da0-d7e8-4f50-851f-f794552db985/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93661","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.943","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Events Manager  WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Events Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"7.4.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:33:34.908014Z","id":"CVE-2026-93661","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/8f1c665e-15e4-4b5d-853d-919723614611/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93662","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:04.050","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Events Manager  WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Events Manager","defaultStatus":"unaffected","versions":[{"version":"7.4.1","lessThan":"7.4.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:33:25.889458Z","id":"CVE-2026-93662","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/5669c4e6-edec-4963-8eb9-fc66d2488049/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-97168","sourceIdentifier":"security@synology.com","published":"2026-09-24T06:17:04.150","lastModified":"2026-09-24T14:18:22.483","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: it is a suggestion"}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-97176","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T06:17:04.227","lastModified":"2026-09-26T23:16:43.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how session re-evaluations are handled, Keycloak may incorrectly issue a token at the lower security level instead of enforcing the required higher level, potentially allowing unauthorized access to sensitive resources that rely on these security claims."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:39:58.730347Z","id":"CVE-2026-97176","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-97176","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539964","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-97177","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T06:17:04.380","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.7,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:57:34.967035Z","id":"CVE-2026-97177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-97177","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539965","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-11744","sourceIdentifier":"eb41dac7-0af8-4f84-9f6d-0272772514f4","published":"2026-09-24T07:16:32.100","lastModified":"2026-09-24T21:08:22.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary code within the context of the application's user interface. This could result in unauthorized actions or information disclosure."}],"affected":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","affectedData":[{"vendor":"PaperCut","product":"PaperCut Hive","defaultStatus":"unaffected","modules":["Embedded App for Ricoh"],"versions":[{"version":"2.0.0","lessThan":"2.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":3.8,"baseSeverity":"LOW","attackVector":"PHYSICAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:40:59.451126Z","id":"CVE-2026-11744","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.papercut.com/kb/Main/security-bulletin-sep-2026/","source":"eb41dac7-0af8-4f84-9f6d-0272772514f4"}]}},{"cve":{"id":"CVE-2026-81645","sourceIdentifier":"psirt@huawei.com","published":"2026-09-24T07:16:33.307","lastModified":"2026-09-24T15:17:40.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"6.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.5,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:40:03.421121Z","id":"CVE-2026-81645","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/9/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/9/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/9/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinwearables/2026/9/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-82077","sourceIdentifier":"eb41dac7-0af8-4f84-9f6d-0272772514f4","published":"2026-09-24T07:16:33.457","lastModified":"2026-10-13T04:17:22.010","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings."}],"affected":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","affectedData":[{"vendor":"PaperCut","product":"PaperCut NG/MF","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"24.1.10","versionType":"semver","status":"affected"},{"version":"25.0.0","lessThan":"25.0.13","versionType":"semver","status":"affected"},{"version":"26.0.0","lessThan":"26.0.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-82077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://www.papercut.com/kb/Main/security-bulletin-sep-2026/","source":"eb41dac7-0af8-4f84-9f6d-0272772514f4"}]}},{"cve":{"id":"CVE-2026-87739","sourceIdentifier":"eb41dac7-0af8-4f84-9f6d-0272772514f4","published":"2026-09-24T07:16:34.780","lastModified":"2026-10-13T04:17:22.743","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information."}],"affected":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","affectedData":[{"vendor":"PaperCut","product":"PaperCut NG/MF","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"24.1.10","versionType":"semver","status":"affected"},{"version":"25.0.0","lessThan":"25.0.13","versionType":"semver","status":"affected"},{"version":"26.0.0","lessThan":"26.0.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:42:13.527939Z","id":"CVE-2026-87739","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://www.papercut.com/kb/Main/security-bulletin-sep-2026/","source":"eb41dac7-0af8-4f84-9f6d-0272772514f4"}]}},{"cve":{"id":"CVE-2026-97181","sourceIdentifier":"twcert@cert.org.tw","published":"2026-09-24T08:17:03.280","lastModified":"2026-09-24T14:45:22.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs."}],"affected":[{"source":"twcert@cert.org.tw","affectedData":[{"vendor":"ezGlobal","product":"GPM LIGHT","defaultStatus":"unaffected","versions":[{"version":"all","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:39:45.881388Z","id":"CVE-2026-97181","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"twcert@cert.org.tw","type":"Secondary","description":[{"lang":"en","value":"CWE-497"}]}],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-11217-86b58-2.html","source":"twcert@cert.org.tw"},{"url":"https://www.twcert.org.tw/tw/cp-132-11216-9ce77-1.html","source":"twcert@cert.org.tw"}]}},{"cve":{"id":"CVE-2026-77193","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T09:17:07.877","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"eesywp","product":"eesy_ID2WP – Publish InDesign HTML5","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:54:58.770435Z","id":"CVE-2026-77193","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3662793/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad266e0f-fc69-4550-b89c-c32ce1221ee4?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-78308","sourceIdentifier":"759f5e80-c8e1-4224-bead-956d7b33c98b","published":"2026-09-24T09:17:08.043","lastModified":"2026-10-15T02:20:16.420","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass.\n\nThis issue affects DIAEnergie: before 1.11.00.022."}],"affected":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","affectedData":[{"vendor":"Deltaww","product":"DIAEnergie","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.00.022","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:36:13.592917Z","id":"CVE-2026-78308","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00014_DIAEnergie%20Multiple%20Vulberabilities%20(CVE-2026-78308%20~%2078313).pdf","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"},{"url":"https://pellera.com/blog/delta-electronics-diaenergie-unauthenticated-remote-code-execution-vulnerability-chain/","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"}]}},{"cve":{"id":"CVE-2026-78309","sourceIdentifier":"759f5e80-c8e1-4224-bead-956d7b33c98b","published":"2026-09-24T09:17:08.187","lastModified":"2026-10-15T03:17:11.340","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SQL Injection vulnerability in DIAEnergie.\n\nThis issue affects DIAEnergie: before 1.11.00.022."}],"affected":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","affectedData":[{"vendor":"Deltaww","product":"DIAEnergie","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.00.022","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:35:52.560561Z","id":"CVE-2026-78309","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00014_DIAEnergie%20Multiple%20Vulberabilities%20(CVE-2026-78308%20~%2078313).pdf","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"},{"url":"https://pellera.com/blog/delta-electronics-diaenergie-unauthenticated-remote-code-execution-vulnerability-chain/","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"}]}},{"cve":{"id":"CVE-2026-78310","sourceIdentifier":"759f5e80-c8e1-4224-bead-956d7b33c98b","published":"2026-09-24T09:17:08.323","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key in DIAEnergie.\n\nThis issue affects DIAEnergie: before 1.11.00.022."}],"affected":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","affectedData":[{"vendor":"Deltaww","product":"DIAEnergie","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.00.022","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:33:52.598510Z","id":"CVE-2026-78310","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00014_DIAEnergie%20Multiple%20Vulberabilities%20(CVE-2026-78308%20~%2078313).pdf","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"}]}},{"cve":{"id":"CVE-2026-78311","sourceIdentifier":"759f5e80-c8e1-4224-bead-956d7b33c98b","published":"2026-09-24T09:17:08.440","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SQL Injection vulnerability in DIAEnergie.\n\nThis issue affects DIAEnergie: before 1.11.00.022."}],"affected":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","affectedData":[{"vendor":"Deltaww","product":"DIAEnergie","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.00.022","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:35:20.495938Z","id":"CVE-2026-78311","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00014_DIAEnergie%20Multiple%20Vulberabilities%20(CVE-2026-78308%20~%2078313).pdf","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"}]}},{"cve":{"id":"CVE-2026-78312","sourceIdentifier":"759f5e80-c8e1-4224-bead-956d7b33c98b","published":"2026-09-24T09:17:08.553","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Path Traversal in DIAEnergie.\n\nThis issue affects DIAEnergie: before 1.11.00.022."}],"affected":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","affectedData":[{"vendor":"Deltaww","product":"DIAEnergie","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.00.022","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:33:33.140598Z","id":"CVE-2026-78312","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00014_DIAEnergie%20Multiple%20Vulberabilities%20(CVE-2026-78308%20~%2078313).pdf","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"}]}},{"cve":{"id":"CVE-2026-78313","sourceIdentifier":"759f5e80-c8e1-4224-bead-956d7b33c98b","published":"2026-09-24T09:17:08.673","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Access Control in DIAEnergie.\n\nThis issue affects DIAEnergie: before 1.11.00.022."}],"affected":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","affectedData":[{"vendor":"Deltaww","product":"DIAEnergie","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.00.022","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:44:30.548734Z","id":"CVE-2026-78313","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00014_DIAEnergie%20Multiple%20Vulberabilities%20(CVE-2026-78308%20~%2078313).pdf","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"}]}},{"cve":{"id":"CVE-2026-85682","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T09:17:08.797","lastModified":"2026-09-24T15:17:46.703","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to steal a REST nonce scoped to a logged-in Administrator and use it to change the Administrator's email address and password, resulting in full account takeover. The Administrator must open an attacker-controlled page in order to exploit this vulnerability."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"yourownprogrammer","product":"YOP Poll","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.0.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:34:56.198122Z","id":"CVE-2026-85682","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3690945/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3574182-1bda-49b2-aac7-60f862891b46?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-97185","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T09:17:08.937","lastModified":"2026-10-19T13:16:59.973","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp:2.8","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"versions":[{"version":"8100020261015094823.4c9c024f","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"versions":[{"version":"2:3.0.4-4.el9_8.14","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:38:43.555462Z","id":"CVE-2026-97185","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:75575","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:84744","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-97185","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539980","source":"secalert@redhat.com"},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/work_items/16788","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-12227","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T10:17:32.623","lastModified":"2026-09-24T16:17:06.650","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"visualcomposer","product":"Visual Composer Website Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"45.16.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:38:03.709954Z","id":"CVE-2026-12227","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-98"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3619572/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/486c1c7c-5a66-42d3-85b0-13ce52a16ed1?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-15731","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T10:17:36.433","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"magazine3","product":"WP Multilang – Translation and Multilingual Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.4.31","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:31:51.518408Z","id":"CVE-2026-15731","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3637485/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31c7b12c-eaab-405e-90da-3c5e8ab47245?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-18335","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T10:17:37.637","lastModified":"2026-09-24T16:17:07.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"themeum","product":"Kirki – Freeform Page Builder, Website Builder & Customizer","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:58:50.774268Z","id":"CVE-2026-18335","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3636487/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/461be8a5-bf72-4028-88e6-bf6544120ac6?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-4637","sourceIdentifier":"551230f0-3615-47bd-b7cc-93e92e730bbf","published":"2026-09-24T10:17:37.813","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a request is made for a non-existent resource ending in \\\".htm\\\", the web interface returns an HTTP 403 \\\"Forbidden Path\\\" error page that echoes the requested URL path into the HTML response body without proper output encoding or sanitization.\n\n\n\n\nAn unauthenticated, remote attacker can craft a URL containing an HTML/JavaScript payload in the path (e.g. https:////welcome.htm) and, once a victim with an active PRTG session opens the crafted link, execute arbitrary JavaScript in the security context of the PRTG web interface. Because the PRTG session cookie is not protected with the HttpOnly attribute, successful exploitation allows the attacker to read and exfiltrate the victim's session cookie, potentially leading to session hijacking."}],"affected":[{"source":"551230f0-3615-47bd-b7cc-93e92e730bbf","affectedData":[{"vendor":"Paessler GmbH","product":"PRTG Network Monitor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"26.2.120.1449","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"551230f0-3615-47bd-b7cc-93e92e730bbf","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:19:37.419469Z","id":"CVE-2026-4637","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"551230f0-3615-47bd-b7cc-93e92e730bbf","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://paessler.freshdesk.com/en/support/solutions/articles/76000088640","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"},{"url":"https://r.sec-consult.com/paessler","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"},{"url":"https://www.paessler.com/de/download/","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"},{"url":"https://www.paessler.com/prtg/prtg-network-monitor","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"},{"url":"https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-paessler-prtg-network-monitor/","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-57590","sourceIdentifier":"security@apache.org","published":"2026-09-24T10:17:38.010","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group.\n\n\n\nThis issue affects Apache DolphinScheduler: before 3.4.3.\n\n\n\nUsers are recommended to upgrade to version 3.4.3, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.dolphinscheduler:dolphinscheduler-api","packageURL":"pkg:maven/org.apache.dolphinscheduler/dolphinscheduler-api","versions":[{"version":"0","lessThan":"3.4.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:37:30.984797Z","id":"CVE-2026-57590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://lists.apache.org/thread/3ncvptkjw9h6s8mjxlwwo30bxxgol6ry","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/3","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-92905","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-24T10:17:38.157","lastModified":"2026-09-24T14:51:56.593","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log collector using malformed syslog packets."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine EventLog Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"13071","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Log360","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"13071","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:41:41.970749Z","id":"CVE-2026-92905","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-248"}]}],"references":[{"url":"https://www.manageengine.com/log-management/advisory/CVE-2026-92905.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-4638","sourceIdentifier":"551230f0-3615-47bd-b7cc-93e92e730bbf","published":"2026-09-24T11:16:45.953","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG provides a documented placeholder variable, %windowspassword, which resolves to the configured Windows/domain password used by PRTG and can be passed as a sensor parameter. \n\n\n\n\nAny PRTG user who is not restricted to read-only access and is permitted to create sensors (the default for non-read-only users) can pass %windowspassword as an argument to the demo VBScript sensor, triggering the type-mismatch error and causing PRTG to display the plaintext password in the sensor's error output."}],"affected":[{"source":"551230f0-3615-47bd-b7cc-93e92e730bbf","affectedData":[{"vendor":"Paessler GmbH","product":"PRTG Network Monitor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"26.2.120.1449","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"551230f0-3615-47bd-b7cc-93e92e730bbf","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:13:17.297572Z","id":"CVE-2026-4638","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"551230f0-3615-47bd-b7cc-93e92e730bbf","type":"Secondary","description":[{"lang":"en","value":"CWE-209"}]}],"references":[{"url":"https://paessler.freshdesk.com/en/support/solutions/articles/76000088640","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"},{"url":"https://r.sec-consult.com/paessler","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"},{"url":"https://www.paessler.com/de/download/","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"},{"url":"https://www.paessler.com/prtg/prtg-network-monitor","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"}]}},{"cve":{"id":"CVE-2026-79680","sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","published":"2026-09-24T11:16:47.117","lastModified":"2026-09-24T21:08:22.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that violates the RFB protocol can bypass Qt VNC Server's password authentication and gain unauthorized remote access to the shared application, compromising the confidentiality and integrity of the session."}],"affected":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","affectedData":[{"vendor":"qt","product":"qt","defaultStatus":"unaffected","modules":["qtvncserver"],"versions":[{"version":"6.4.0","lessThan":"6.8.9","versionType":"python","status":"affected"},{"version":"6.9.0","lessThan":"6.11.3","versionType":"python","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:X","baseScore":4.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"LOW","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:17:35.115651Z","id":"CVE-2026-79680","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","description":[{"lang":"en","value":"CWE-288"}]}],"references":[{"url":"https://codereview.qt-project.org/c/qt/tqtc-qtvncserver/+/759160","source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"},{"url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-79680:","source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}]}},{"cve":{"id":"CVE-2026-97179","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T11:17:06.600","lastModified":"2026-09-24T16:17:28.597","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the component Cipher Connection Handler. Such manipulation of the argument fileUrl leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"O2OA","cpes":["cpe:2.3:a:o2oa:o2oa:*:*:*:*:*:*:*:*"],"modules":["Cipher Connection Handler"],"versions":[{"version":"9.5.0","status":"affected"},{"version":"9.5.1","status":"affected"},{"version":"9.5.2","status":"affected"},{"version":"9.5.3","status":"affected"},{"version":"10.0.0","status":"affected"},{"version":"10.0.1","status":"affected"},{"version":"10.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:14:49.203301Z","id":"CVE-2026-97179","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/2H-K/myvuls/issues/3","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97179","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/907501","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409281","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409281/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-16302","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T12:17:11.637","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editor_assets function,  which exposes the uag_insta_linked_accounts option through the uagb_blocks_info object without a capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw Instagram Graph API access tokens configured by an administrator. Exploitation requires the Spectra Pro plugin to be active with a linked Instagram account."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"brainstormforce","product":"Spectra Legacy – Gutenberg Blocks","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.20.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T11:53:10.888142Z","id":"CVE-2026-16302","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3630074/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eede8a1e-db33-4c07-9991-9def75dddc87?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-19532","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-24T12:17:12.030","lastModified":"2026-09-24T19:36:51.280","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal.\n\nThis issue affects Liman MYS: from 2.3.2 before 2.3.4-1124."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"HAVELSAN Inc.","product":"Liman MYS","defaultStatus":"unaffected","versions":[{"version":"2.3.2","lessThan":"2.3.4-1124","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:19:46.434369Z","id":"CVE-2026-19532","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1169","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-3253","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T12:17:12.160","lastModified":"2026-09-24T15:17:21.977","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"mailerlite","product":"MailerLite – Signup forms (official)","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.7.21","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:33:53.170720Z","id":"CVE-2026-3253","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3505999/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d845767-1e5f-43f0-9fc6-a897c2d5c3dd?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-4806","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T12:17:12.307","lastModified":"2026-09-24T16:17:07.523","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the save_option() function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to export or reset(delete) the plugin's settings."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"alexvtn","product":"Custom Thank You Page for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.1.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:05:23.275023Z","id":"CVE-2026-4806","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3507079","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a010d1a2-b848-4d62-b176-a2c8e2027656?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-7169","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-09-24T12:17:12.973","lastModified":"2026-09-24T14:45:22.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a ‘wtsapi32.dll’ file in the ‘C:\\ProgramData\\Evope\\’ directory. The ‘Evope.Service.exe’ component, which runs with ‘NT AUTHORITY\\SYSTEM’ privileges, loads this DLL without properly verifying its integrity or origin. Successful exploitation could allow code execution with SYSTEM privileges and result in local privilege escalation."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"Evope Collector","product":"Evope Collector","defaultStatus":"unaffected","versions":[{"version":"1.1.6.9.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:05:07.092305Z","id":"CVE-2026-7169","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/uncontrolled-search-path-element-evope-collector","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-97311","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T12:17:13.943","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions that should limit their view to specific groups."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:31:24.446908Z","id":"CVE-2026-97311","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-97311","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-19072","sourceIdentifier":"cve@rapid7.com","published":"2026-09-24T13:17:09.500","lastModified":"2026-09-25T04:17:34.920","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field \"compiled_collector_args\" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of \"investigator\" ) to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied.\n\n\n\n\nThis flaw can then be escalated to allow the \"investigator\" user to run arbitrary VQL statements as an administrator user on the Velociraptor server."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Rapid7","product":"Velociraptor","defaultStatus":"unaffected","repo":"https://github.com/Velocidex/velociraptor/","versions":[{"version":"0","lessThan":"0.77.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-19072","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-164"},{"lang":"en","value":"CWE-1269"}]}],"references":[{"url":"https://docs.velociraptor.app/announcements/advisories/cve-2026-19072/","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-88907","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-24T13:17:15.873","lastModified":"2026-09-24T19:36:51.280","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass.\n\nThis issue affects UlakPDF: through 09092026."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"TÜBİTAK ULAKBİM","product":"UlakPDF","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"09092026","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:41:31.719339Z","id":"CVE-2026-88907","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1170","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-88916","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-24T13:17:16.060","lastModified":"2026-09-24T19:36:51.280","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation.\n\nThis issue affects UlakPDF: through 09092026."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"TÜBİTAK ULAKBİM","product":"UlakPDF","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"09092026","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:41:52.048253Z","id":"CVE-2026-88916","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1170","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-94416","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T13:17:17.620","lastModified":"2026-10-21T20:17:27.867","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an administrator-issued key is cryptographically indistinguishable from a legitimate one and can be used to forge a service-authentication token that impersonates the Controller service. Combined with the gateway OIDC workload-identity endpoint (enabled via FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED), the attacker can drive the gateway to sign Workload Identity Tokens (WITs) for arbitrary Controller workloads. A downstream resource server such as HashiCorp Vault that trusts the gateway OIDC key will accept the forged WIT and return the AAP credentials bound to that workload, disclosing secrets beyond the attacker's authorization boundary."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-gateway","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:2.6.20261019-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/gateway-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1792429216","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-25/gateway-rhel8","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/gateway-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:58:49.431691Z","id":"CVE-2026-94416","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:87004","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:87124","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-94416","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537465","source":"secalert@redhat.com"},{"url":"https://github.com/ansible/ansible.platform/pull/254","source":"secalert@redhat.com"},{"url":"https://github.com/ansible/jewel/pull/235","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-96515","sourceIdentifier":"vdisclose@cert-in.org.in","published":"2026-09-24T13:17:17.787","lastModified":"2026-10-12T12:17:15.633","vulnStatus":"Deferred","cveTags":[{"sourceIdentifier":"vdisclose@cert-in.org.in","tags":["disputed"]}],"descriptions":[{"lang":"en","value":"This\nvulnerability exists in the Netlink ICT HG323RW router due to insufficient\nauthorization and input validation controls in the diagnostic script import\nfunctionality. An authenticated attacker could exploit this vulnerability by\nuploading and executing a specially crafted script through the web management\ninterface.\n\n\n\n\n\nSuccessful exploitation of this vulnerability\ncould allow the attacker to execute arbitrary operating system commands with\nroot privileges resulting in complete compromise of the affected device."}],"affected":[{"source":"vdisclose@cert-in.org.in","affectedData":[{"vendor":"Netlink ICT Pvt Ltd","product":"Netlink ICT HG323RW Router","defaultStatus":"unaffected","versions":[{"version":"Hardware Version (V3.7) and Affected Firmware (3.1.02-260228 Netlinkver)","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vdisclose@cert-in.org.in","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:40:29.568639Z","id":"CVE-2026-96515","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vdisclose@cert-in.org.in","type":"Secondary","description":[{"lang":"en","value":"CWE-434"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0473","source":"vdisclose@cert-in.org.in"}]}},{"cve":{"id":"CVE-2026-97182","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T13:17:19.507","lastModified":"2026-09-24T15:18:01.087","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper neutralization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"halo-dev","product":"Halo","cpes":["cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:*"],"modules":["SpEL Handler"],"versions":[{"version":"2.25.0","status":"affected"},{"version":"2.25.1","status":"affected"},{"version":"2.25.2","status":"affected"},{"version":"2.25.3","status":"affected"},{"version":"2.25.4","status":"affected"},{"version":"2.26.0","status":"affected"},{"version":"2.26.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:32:48.451763Z","id":"CVE-2026-97182","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-707"}]}],"references":[{"url":"https://note-hxlab.wetolink.com/share/jTI97vuXfcCY","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97182","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/907507","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409299","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409299/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-17413","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T14:17:11.887","lastModified":"2026-09-30T16:59:47.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the RTAS firmware-to-OS interface. An attacker with administrator-level (root) access to a logical partition can send a specially crafted request to partition firmware, causing the partition to crash and become unavailable. Other partitions on the same managed system are not affected."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"PowerVM Hypervisor","cpes":["cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3.0:*:*:*:*:*:*:*"],"versions":[{"version":"FW1120.00","lessThanOrEqual":"FW1120.01","versionType":"semver","status":"affected"},{"version":"FW1110.00","lessThanOrEqual":"FW1110.31","versionType":"semver","status":"affected"},{"version":"FW1060.00","lessThanOrEqual":"FW1060.81","versionType":"semver","status":"affected"},{"version":"FW950.00","lessThanOrEqual":"FW950.H3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:55:33.505196Z","id":"CVE-2026-17413","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-129"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"7EA43BB6-6776-4E2F-A279-E30E844EF1C2"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"EC2FA374-2ADB-45C1-ACA1-D39BAD709067"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"96C2DEDC-012D-4B9F-B9DF-344A49B67E46"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"F9475E71-FA18-43A1-902A-2E21C777D254"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"A66F38F0-55B5-444F-968D-718170852B0A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3F51514A-8E29-42D1-B874-838F8A0869D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"D11BE622-6276-49D9-B394-EB615E3C5BFD"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"E9E20EAA-BBEE-4924-9BBA-07D6DE018509"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"26E1E16B-8F95-46EC-BAA0-0A53F332292B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"B7048C65-6872-4F5B-9691-D74E269E1CF9"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"96EEE277-E80A-4380-A4C4-9E2CCF6E8C52"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8688E552-BE38-4EB9-8514-D7060C548C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"BB22063C-C9A0-4D69-95FC-3B19ACDC6B21"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"76154775-CAE7-43F1-A14D-CA092F5539D1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"82AEF0FF-068C-4123-BEFB-7D3584F1B15A"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"82BC7AD7-3F24-4EE7-9360-4024A6CC319C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"57896A45-2625-4C51-9B3E-5B934979FA33"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"4AB43439-0F5B-4839-A109-E14E726CAD27"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*","matchCriteriaId":"AC9D9EFF-1E92-4894-9976-001227F78869"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"F95F4E4A-7374-40FB-AC3B-AEF7AE607CEF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B3F5100A-FE2A-412C-9B57-B616B97B1142"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"D79F90A7-5929-4893-BC72-4CF11BDB4F9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*","matchCriteriaId":"EA825307-2083-4264-8E8B-798661285261"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1080_\\(9080-hex\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1681A01A-7020-427B-848A-6E3CC0FE1E5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1080_\\(9080-hex\\):-:*:*:*:*:*:*:*","matchCriteriaId":"DF85251B-E02C-4293-98F0-D331BF51CAC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"8E228E48-523F-4486-8A29-5DB61851B1F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"38AE73EA-12AE-4E46-8435-259AD1773403"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E49EE658-B8AE-48F7-A765-92BA3A630AA0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"DD0351D8-3E79-4A28-BC5E-ADD9551238BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"C5578070-8EEC-4A76-A07F-5094DCF69A49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"ECD54B80-5754-4C19-AE0C-F539DEF96DCB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7097B3B4-A5BF-4B60-8FAA-6D8D4BA1A44E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B2C09090-C18F-464A-8DEF-E23B5990E2A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1E9CBB70-ACFC-4904-8CFB-16D3672FE3CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"0170400B-89A7-4B44-9AA7-9A168C9CAE9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"CA91958A-CDF9-4360-8886-00E38A8B7366"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*","matchCriteriaId":"061D193E-84BC-4DE7-96C4-B75D11769ED5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7F1D438E-4AFC-4BAC-AD5B-B6152FFEA821"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"7BED85F2-8CCB-417C-A739-23828966A036"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"6A492561-E2C8-4EAE-8D31-F20DA413BABC"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"90F8D763-A95F-4189-82DB-1DD6B134D244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1180_\\(9080-heu\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s922_\\(9009-22g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"A7A29250-6BFF-4BFD-8723-A584F5AFDD67"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s922_\\(9009-22g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"95E5E77F-A5BB-46E7-B6B6-B02F242DE829"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h922_\\(9223-22s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"852BF98B-82A6-4A6A-9541-BB65A2CDF650"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h922_\\(9223-22s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E7851003-8D6B-4FE8-87D7-BE968E85E448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s914_\\(9009-41g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D71B426C-DDDF-4341-9A2E-6A36569A1839"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s914_\\(9009-41g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"003F591A-ACCD-497E-BF8A-DE090321D778"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s924_\\(9009-42g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"E0EDDB11-824F-4E4E-838C-2A5AE1A79C0C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s924_\\(9009-42g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"4038C5DB-DF9C-4661-9590-F6A0CD4D15D5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h924_\\(9223-42s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"2A4BBB63-0102-44F0-AF76-4245872B2F89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h924_\\(9223-42s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"C2F0E93A-26F0-4914-8A31-3C86E64D5B8A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e950_\\(9040-mr9\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D4A756BD-C31D-4457-8B50-305B32E92785"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e950_\\(9040-mr9\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9FF58E5C-0A54-4F2F-A426-0BFD1EACE991"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e980_\\(9080-m9s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"52CB0665-0AE6-4A6E-A629-8AB47C7837C5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e980_\\(9080-m9s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9BE56BD8-DB0F-4151-9428-42F1B6452D99"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289124","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-17503","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T14:17:12.063","lastModified":"2026-09-30T16:57:44.550","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter partition nvram, causing the partition to fail to boot. This condition persists until operator intervention — deleting and recreating the partition configuration — to restore normal operation. Successful exploitation results in an integrity and availability impact."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"PowerVM Hypervisor","cpes":["cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3.0:*:*:*:*:*:*:*"],"versions":[{"version":"FW1120.00","lessThanOrEqual":"FW1120.01","versionType":"semver","status":"affected"},{"version":"FW1110.00","lessThanOrEqual":"FW1110.31","versionType":"semver","status":"affected"},{"version":"FW1060.00","lessThanOrEqual":"FW1060.81","versionType":"semver","status":"affected"},{"version":"FW950.00","lessThanOrEqual":"FW950.H3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:52:58.999216Z","id":"CVE-2026-17503","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"7EA43BB6-6776-4E2F-A279-E30E844EF1C2"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"EC2FA374-2ADB-45C1-ACA1-D39BAD709067"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"96C2DEDC-012D-4B9F-B9DF-344A49B67E46"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"F9475E71-FA18-43A1-902A-2E21C777D254"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"A66F38F0-55B5-444F-968D-718170852B0A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3F51514A-8E29-42D1-B874-838F8A0869D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"D11BE622-6276-49D9-B394-EB615E3C5BFD"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"E9E20EAA-BBEE-4924-9BBA-07D6DE018509"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"26E1E16B-8F95-46EC-BAA0-0A53F332292B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"B7048C65-6872-4F5B-9691-D74E269E1CF9"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"96EEE277-E80A-4380-A4C4-9E2CCF6E8C52"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8688E552-BE38-4EB9-8514-D7060C548C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"BB22063C-C9A0-4D69-95FC-3B19ACDC6B21"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"76154775-CAE7-43F1-A14D-CA092F5539D1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"82AEF0FF-068C-4123-BEFB-7D3584F1B15A"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"82BC7AD7-3F24-4EE7-9360-4024A6CC319C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"57896A45-2625-4C51-9B3E-5B934979FA33"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"4AB43439-0F5B-4839-A109-E14E726CAD27"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*","matchCriteriaId":"AC9D9EFF-1E92-4894-9976-001227F78869"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"F95F4E4A-7374-40FB-AC3B-AEF7AE607CEF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B3F5100A-FE2A-412C-9B57-B616B97B1142"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"D79F90A7-5929-4893-BC72-4CF11BDB4F9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*","matchCriteriaId":"EA825307-2083-4264-8E8B-798661285261"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1080_\\(9080-hex\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1681A01A-7020-427B-848A-6E3CC0FE1E5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1080_\\(9080-hex\\):-:*:*:*:*:*:*:*","matchCriteriaId":"DF85251B-E02C-4293-98F0-D331BF51CAC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"8E228E48-523F-4486-8A29-5DB61851B1F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"38AE73EA-12AE-4E46-8435-259AD1773403"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E49EE658-B8AE-48F7-A765-92BA3A630AA0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"DD0351D8-3E79-4A28-BC5E-ADD9551238BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"C5578070-8EEC-4A76-A07F-5094DCF69A49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"ECD54B80-5754-4C19-AE0C-F539DEF96DCB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7097B3B4-A5BF-4B60-8FAA-6D8D4BA1A44E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B2C09090-C18F-464A-8DEF-E23B5990E2A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1E9CBB70-ACFC-4904-8CFB-16D3672FE3CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"0170400B-89A7-4B44-9AA7-9A168C9CAE9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"CA91958A-CDF9-4360-8886-00E38A8B7366"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*","matchCriteriaId":"061D193E-84BC-4DE7-96C4-B75D11769ED5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7F1D438E-4AFC-4BAC-AD5B-B6152FFEA821"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"7BED85F2-8CCB-417C-A739-23828966A036"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"6A492561-E2C8-4EAE-8D31-F20DA413BABC"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"90F8D763-A95F-4189-82DB-1DD6B134D244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1180_\\(9080-heu\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s922_\\(9009-22g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"A7A29250-6BFF-4BFD-8723-A584F5AFDD67"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s922_\\(9009-22g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"95E5E77F-A5BB-46E7-B6B6-B02F242DE829"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h922_\\(9223-22s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"852BF98B-82A6-4A6A-9541-BB65A2CDF650"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h922_\\(9223-22s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E7851003-8D6B-4FE8-87D7-BE968E85E448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s914_\\(9009-41g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D71B426C-DDDF-4341-9A2E-6A36569A1839"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s914_\\(9009-41g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"003F591A-ACCD-497E-BF8A-DE090321D778"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s924_\\(9009-42g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"E0EDDB11-824F-4E4E-838C-2A5AE1A79C0C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s924_\\(9009-42g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"4038C5DB-DF9C-4661-9590-F6A0CD4D15D5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h924_\\(9223-42s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"2A4BBB63-0102-44F0-AF76-4245872B2F89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h924_\\(9223-42s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"C2F0E93A-26F0-4914-8A31-3C86E64D5B8A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e950_\\(9040-mr9\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D4A756BD-C31D-4457-8B50-305B32E92785"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e950_\\(9040-mr9\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9FF58E5C-0A54-4F2F-A426-0BFD1EACE991"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e980_\\(9080-m9s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"52CB0665-0AE6-4A6E-A629-8AB47C7837C5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e980_\\(9080-m9s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9BE56BD8-DB0F-4151-9428-42F1B6452D99"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289133","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-17504","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T14:17:12.230","lastModified":"2026-09-29T14:58:26.860","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime. An attacker with root access to a partition can send a specially crafted request to the partition firmware runtime, causing it to crash with possible memory corruption."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"PowerVM Hypervisor","cpes":["cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3.0:*:*:*:*:*:*:*"],"versions":[{"version":"FW1120.00","lessThanOrEqual":"FW1120.01","versionType":"semver","status":"affected"},{"version":"FW1110.00","lessThanOrEqual":"FW1110.31","versionType":"semver","status":"affected"},{"version":"FW1060.00","lessThanOrEqual":"FW1060.81","versionType":"semver","status":"affected"},{"version":"FW950.00","lessThanOrEqual":"FW950.H3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:31:35.705386Z","id":"CVE-2026-17504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-191"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"C016EFBA-A371-4264-A823-A7635D39F6D9"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"B8707806-84E4-442B-A29F-7BF44514F8DA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"96C2DEDC-012D-4B9F-B9DF-344A49B67E46"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"6B512BF5-7D6B-45EA-97B8-F22B63A62270"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"25BCA648-5FF1-4B90-98ED-23E5BB217465"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3F51514A-8E29-42D1-B874-838F8A0869D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"BC8256E1-574D-4666-BE1B-45977348AC86"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"2165EAA9-EDC9-4010-9D31-294F9414A9E6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"26E1E16B-8F95-46EC-BAA0-0A53F332292B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"3F8C1054-A539-468C-9A5F-E6E686C6CE8A"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"085F1C27-D806-4E4B-A44A-BB3C056CFCF7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8688E552-BE38-4EB9-8514-D7060C548C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"37868E6E-7759-4CCB-995E-BDB7F61F6818"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"50916B93-7340-4344-AF34-91836ABE508F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"9F0FE92C-3510-475A-8D02-ED17ADD87CD0"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"FECCD687-64E7-45B4-BCB7-AEF25164D049"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"DC4CCBFC-3120-475D-BF75-025C04E41B91"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"BE428FBB-4DDC-4E05-A5C3-F37BE9395723"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*","matchCriteriaId":"AC9D9EFF-1E92-4894-9976-001227F78869"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"6505E499-E766-451D-9996-1668BE53AAF8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B3F5100A-FE2A-412C-9B57-B616B97B1142"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"109DE27E-5F87-4BD0-8C48-F72A1C2AD55D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*","matchCriteriaId":"EA825307-2083-4264-8E8B-798661285261"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1080_\\(9080-hex\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"AA6D803F-DD5C-49A7-BE93-68981C124C69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1080_\\(9080-hex\\):-:*:*:*:*:*:*:*","matchCriteriaId":"DF85251B-E02C-4293-98F0-D331BF51CAC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"0BB54554-C9DC-4072-A205-EA9DD4E15688"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"FA4B835D-CEAB-422B-9F38-F63AF84396C3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E49EE658-B8AE-48F7-A765-92BA3A630AA0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"51C2576F-E4DD-4002-9E41-CF89F92E2064"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"41572D5A-C3A2-4294-9AF9-D4824675B4A3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"ECD54B80-5754-4C19-AE0C-F539DEF96DCB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"EEBFE6F7-E6D8-47AC-B011-751FB9BC3D50"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B2C09090-C18F-464A-8DEF-E23B5990E2A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"D6EA818B-DC65-4F2D-9FC9-C610FFABE3DD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"0170400B-89A7-4B44-9AA7-9A168C9CAE9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"2F04E3C9-94C6-42B0-9FBD-4AC5FEF42A1F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*","matchCriteriaId":"061D193E-84BC-4DE7-96C4-B75D11769ED5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"0524365D-8379-4B10-B9C5-FF80EE84BA27"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"7BED85F2-8CCB-417C-A739-23828966A036"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"E8049F52-227B-4CCA-B059-5821F9B41C95"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"F518B3DD-3F25-4581-9103-6CD4D8DA54C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1180_\\(9080-heu\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s922_\\(9009-22g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h3","matchCriteriaId":"0C406C5A-454C-4454-861F-80E629B68418"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s922_\\(9009-22g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"95E5E77F-A5BB-46E7-B6B6-B02F242DE829"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h922_\\(9223-22s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h3","matchCriteriaId":"FBE7D8B3-902D-4CD1-9F31-454E293A79B3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h922_\\(9223-22s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E7851003-8D6B-4FE8-87D7-BE968E85E448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s914_\\(9009-41g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h3","matchCriteriaId":"CD77C09F-AF62-4CD8-B64C-CDF50D696648"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s914_\\(9009-41g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"003F591A-ACCD-497E-BF8A-DE090321D778"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s924_\\(9009-42g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h3","matchCriteriaId":"54831AF9-D748-4649-A0ED-896341845BCD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s924_\\(9009-42g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"4038C5DB-DF9C-4661-9590-F6A0CD4D15D5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h924_\\(9223-42s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h3","matchCriteriaId":"64FD3222-EEFD-4533-A088-B05F04E0831D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h924_\\(9223-42s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"C2F0E93A-26F0-4914-8A31-3C86E64D5B8A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e950_\\(9040-mr9\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h3","matchCriteriaId":"C99CF91B-A98D-4795-A8AE-998713989ABE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e950_\\(9040-mr9\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9FF58E5C-0A54-4F2F-A426-0BFD1EACE991"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e980_\\(9080-m9s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h3","matchCriteriaId":"272B1267-28AC-4BDB-93C4-9804DBE240E0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e980_\\(9080-m9s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9BE56BD8-DB0F-4151-9428-42F1B6452D99"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289130","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-17511","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T14:17:12.387","lastModified":"2026-09-30T16:53:54.353","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition resource dump interface. An attacker with authenticated administrator-level access to the HMC or service processor can obtain a limited snapshot of partition processor state. Successful exploitation results in a confidentiality impact to the managed system."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"PowerVM Hypervisor","cpes":["cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3.0:*:*:*:*:*:*:*"],"versions":[{"version":"FW1120.00","lessThanOrEqual":"FW1120.01","versionType":"semver","status":"affected"},{"version":"FW1110.00","lessThanOrEqual":"FW1110.31","versionType":"semver","status":"affected"},{"version":"FW1060.00","lessThanOrEqual":"FW1060.81","versionType":"semver","status":"affected"},{"version":"FW950.00","lessThanOrEqual":"FW950.H3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","baseScore":3.4,"baseSeverity":"LOW","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:50:35.938244Z","id":"CVE-2026-17511","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-212"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"7EA43BB6-6776-4E2F-A279-E30E844EF1C2"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"EC2FA374-2ADB-45C1-ACA1-D39BAD709067"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"96C2DEDC-012D-4B9F-B9DF-344A49B67E46"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"F9475E71-FA18-43A1-902A-2E21C777D254"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"A66F38F0-55B5-444F-968D-718170852B0A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3F51514A-8E29-42D1-B874-838F8A0869D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"D11BE622-6276-49D9-B394-EB615E3C5BFD"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"E9E20EAA-BBEE-4924-9BBA-07D6DE018509"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"26E1E16B-8F95-46EC-BAA0-0A53F332292B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"B7048C65-6872-4F5B-9691-D74E269E1CF9"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"96EEE277-E80A-4380-A4C4-9E2CCF6E8C52"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8688E552-BE38-4EB9-8514-D7060C548C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"BB22063C-C9A0-4D69-95FC-3B19ACDC6B21"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"76154775-CAE7-43F1-A14D-CA092F5539D1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"82AEF0FF-068C-4123-BEFB-7D3584F1B15A"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"82BC7AD7-3F24-4EE7-9360-4024A6CC319C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"57896A45-2625-4C51-9B3E-5B934979FA33"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"4AB43439-0F5B-4839-A109-E14E726CAD27"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*","matchCriteriaId":"AC9D9EFF-1E92-4894-9976-001227F78869"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"F95F4E4A-7374-40FB-AC3B-AEF7AE607CEF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B3F5100A-FE2A-412C-9B57-B616B97B1142"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"D79F90A7-5929-4893-BC72-4CF11BDB4F9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*","matchCriteriaId":"EA825307-2083-4264-8E8B-798661285261"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1080_\\(9080-hex\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1681A01A-7020-427B-848A-6E3CC0FE1E5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1080_\\(9080-hex\\):-:*:*:*:*:*:*:*","matchCriteriaId":"DF85251B-E02C-4293-98F0-D331BF51CAC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"8E228E48-523F-4486-8A29-5DB61851B1F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"38AE73EA-12AE-4E46-8435-259AD1773403"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E49EE658-B8AE-48F7-A765-92BA3A630AA0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"DD0351D8-3E79-4A28-BC5E-ADD9551238BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"C5578070-8EEC-4A76-A07F-5094DCF69A49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"ECD54B80-5754-4C19-AE0C-F539DEF96DCB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7097B3B4-A5BF-4B60-8FAA-6D8D4BA1A44E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B2C09090-C18F-464A-8DEF-E23B5990E2A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1E9CBB70-ACFC-4904-8CFB-16D3672FE3CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"0170400B-89A7-4B44-9AA7-9A168C9CAE9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"CA91958A-CDF9-4360-8886-00E38A8B7366"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*","matchCriteriaId":"061D193E-84BC-4DE7-96C4-B75D11769ED5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7F1D438E-4AFC-4BAC-AD5B-B6152FFEA821"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"7BED85F2-8CCB-417C-A739-23828966A036"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"6A492561-E2C8-4EAE-8D31-F20DA413BABC"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"90F8D763-A95F-4189-82DB-1DD6B134D244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1180_\\(9080-heu\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s922_\\(9009-22g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"A7A29250-6BFF-4BFD-8723-A584F5AFDD67"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s922_\\(9009-22g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"95E5E77F-A5BB-46E7-B6B6-B02F242DE829"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h922_\\(9223-22s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"852BF98B-82A6-4A6A-9541-BB65A2CDF650"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h922_\\(9223-22s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E7851003-8D6B-4FE8-87D7-BE968E85E448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s914_\\(9009-41g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D71B426C-DDDF-4341-9A2E-6A36569A1839"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s914_\\(9009-41g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"003F591A-ACCD-497E-BF8A-DE090321D778"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s924_\\(9009-42g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"E0EDDB11-824F-4E4E-838C-2A5AE1A79C0C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s924_\\(9009-42g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"4038C5DB-DF9C-4661-9590-F6A0CD4D15D5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h924_\\(9223-42s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"2A4BBB63-0102-44F0-AF76-4245872B2F89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h924_\\(9223-42s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"C2F0E93A-26F0-4914-8A31-3C86E64D5B8A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e950_\\(9040-mr9\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D4A756BD-C31D-4457-8B50-305B32E92785"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e950_\\(9040-mr9\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9FF58E5C-0A54-4F2F-A426-0BFD1EACE991"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e980_\\(9080-m9s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"52CB0665-0AE6-4A6E-A629-8AB47C7837C5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e980_\\(9080-m9s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9BE56BD8-DB0F-4151-9428-42F1B6452D99"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289132","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-18104","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T14:17:12.553","lastModified":"2026-09-29T14:00:07.947","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Db2 Mirror for i","cpes":["cpe:2.3:a:ibm:db2_mirror_for_i:7.6:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_mirror_for_i:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_mirror_for_i:7.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_mirror_for_i:7.5.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_mirror_for_i:7.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_mirror_for_i:7.4.0:*:*:*:*:*:*:*"],"versions":[{"version":"7.6","status":"affected"},{"version":"7.5","status":"affected"},{"version":"7.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:40:06.994328Z","id":"CVE-2026-18104","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-327"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2_mirror_for_i:*:*:*:*:*:*:*:*","versionStartIncluding":"7.4","versionEndIncluding":"7.6","matchCriteriaId":"E01FA903-74C4-4F19-9DF6-A5AACD6DF475"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289246","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-18857","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T14:17:12.680","lastModified":"2026-09-30T16:48:23.090","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to be read, resulting in a confidentiality and availability impact to the managed system."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"OPENBMC","cpes":["cpe:2.3:a:ibm:openbmc:fw1120.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1120.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1120.01:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1120.01.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1110.31:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1110.31.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1060.81.0:*:*:*:*:*:*:*"],"versions":[{"version":"FW1120.00","lessThanOrEqual":"FW1120.01","versionType":"semver","status":"affected"},{"version":"FW1110.00","lessThanOrEqual":"FW1110.31","versionType":"semver","status":"affected"},{"version":"FW1060.00","lessThanOrEqual":"FW1060.81","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L","baseScore":3.4,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":0.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:54:25.176870Z","id":"CVE-2026-18857","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"7EA43BB6-6776-4E2F-A279-E30E844EF1C2"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"EC2FA374-2ADB-45C1-ACA1-D39BAD709067"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"96C2DEDC-012D-4B9F-B9DF-344A49B67E46"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"F9475E71-FA18-43A1-902A-2E21C777D254"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"A66F38F0-55B5-444F-968D-718170852B0A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3F51514A-8E29-42D1-B874-838F8A0869D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"D11BE622-6276-49D9-B394-EB615E3C5BFD"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"E9E20EAA-BBEE-4924-9BBA-07D6DE018509"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"26E1E16B-8F95-46EC-BAA0-0A53F332292B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"B7048C65-6872-4F5B-9691-D74E269E1CF9"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"96EEE277-E80A-4380-A4C4-9E2CCF6E8C52"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8688E552-BE38-4EB9-8514-D7060C548C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"BB22063C-C9A0-4D69-95FC-3B19ACDC6B21"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"76154775-CAE7-43F1-A14D-CA092F5539D1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"82AEF0FF-068C-4123-BEFB-7D3584F1B15A"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"82BC7AD7-3F24-4EE7-9360-4024A6CC319C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"57896A45-2625-4C51-9B3E-5B934979FA33"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"4AB43439-0F5B-4839-A109-E14E726CAD27"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*","matchCriteriaId":"AC9D9EFF-1E92-4894-9976-001227F78869"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"F95F4E4A-7374-40FB-AC3B-AEF7AE607CEF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B3F5100A-FE2A-412C-9B57-B616B97B1142"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"D79F90A7-5929-4893-BC72-4CF11BDB4F9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*","matchCriteriaId":"EA825307-2083-4264-8E8B-798661285261"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"8E228E48-523F-4486-8A29-5DB61851B1F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"38AE73EA-12AE-4E46-8435-259AD1773403"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E49EE658-B8AE-48F7-A765-92BA3A630AA0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"DD0351D8-3E79-4A28-BC5E-ADD9551238BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"C5578070-8EEC-4A76-A07F-5094DCF69A49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"ECD54B80-5754-4C19-AE0C-F539DEF96DCB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7097B3B4-A5BF-4B60-8FAA-6D8D4BA1A44E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B2C09090-C18F-464A-8DEF-E23B5990E2A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1E9CBB70-ACFC-4904-8CFB-16D3672FE3CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"0170400B-89A7-4B44-9AA7-9A168C9CAE9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"CA91958A-CDF9-4360-8886-00E38A8B7366"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*","matchCriteriaId":"061D193E-84BC-4DE7-96C4-B75D11769ED5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7F1D438E-4AFC-4BAC-AD5B-B6152FFEA821"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"7BED85F2-8CCB-417C-A739-23828966A036"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289253","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-77797","sourceIdentifier":"cve@rapid7.com","published":"2026-09-24T14:18:17.247","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Rapid7","product":"Velociraptor","defaultStatus":"unaffected","packageName":"Velociraptor","platforms":["Windows"],"repo":"https://github.com/Velocidex/velociraptor/","versions":[{"version":"0","lessThan":"0.77.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","baseScore":3.6,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:47:47.888267Z","id":"CVE-2026-77797","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"http://docs.velociraptor.app/announcements/advisories/cve-2026-7797/","source":"cve@rapid7.com"},{"url":"https://github.com/Velocidex/go-prefetch/commit/4bae9796298011598d577b125e0b3db3ee03eb74","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-77798","sourceIdentifier":"cve@rapid7.com","published":"2026-09-24T14:18:17.373","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Rapid7","product":"Velociraptor","defaultStatus":"unaffected","packageName":"Velociraptor","platforms":["Linux"],"repo":"https://github.com/Velocidex/velociraptor/","versions":[{"version":"0","lessThan":"0.77.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:48:32.322715Z","id":"CVE-2026-77798","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-833"}]}],"references":[{"url":"http://docs.velociraptor.app/announcements/advisories/cve-2026-7798/","source":"cve@rapid7.com"},{"url":"https://github.com/Velocidex/velociraptor/commit/b64d915422da2e8366781bea2b5c5e6808df829c","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-88359","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T14:18:18.320","lastModified":"2026-09-25T17:17:17.490","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a very large literal or folded block scalar, the function repeatedly grows an internal buffer using alloca() inside a loop. The allocated stack memory is not released until the function returns, causing cumulative stack growth that can exceed the process stack limit and result in SIGSEGV and denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:18:24.616054Z","id":"CVE-2026-88359","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/pantoniou/libfyaml/commit/20502068902d58c076da873117985798df2c7e74","source":"cve@mitre.org"},{"url":"https://github.com/pantoniou/libfyaml/commit/93741a7c9331da9da65ef7a25f2d7d6a817a1c29","source":"cve@mitre.org"},{"url":"https://github.com/pantoniou/libfyaml/issues/315","source":"cve@mitre.org"},{"url":"https://github.com/pantoniou/libfyaml/issues/315","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88360","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T14:18:18.440","lastModified":"2026-10-06T18:16:57.183","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel data at an address that is not properly aligned for float access. vips_avg_scan() subsequently dereferences the buffer through a float pointer, resulting in undefined behavior and process termination on strict-alignment architectures or UBSan-instrumented builds, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:50:30.333838Z","id":"CVE-2026-88360","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-1339"}]}],"references":[{"url":"https://github.com/libvips/libvips/issues/5187","source":"cve@mitre.org"},{"url":"https://github.com/libvips/libvips/issues/5187","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-91187","sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","published":"2026-09-24T14:18:18.667","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected.\n\nverify_token/2 in lib/nimble_zta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {_, token, _s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verify_iss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity.\n\nThis issue affects nimble_zta: from 0.1.2 before 0.1.3."}],"affected":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","affectedData":[{"vendor":"dashbit","product":"nimble_zta","defaultStatus":"unaffected","collectionURL":"https://repo.hex.pm","packageName":"nimble_zta","cpes":["cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*"],"modules":["'Elixir.NimbleZTA.Cloudflare'"],"programFiles":["lib/nimble_zta/cloudflare.ex"],"programRoutines":[{"name":"'Elixir.NimbleZTA.Cloudflare':authenticate/3"},{"name":"'Elixir.NimbleZTA.Cloudflare':verify_token/2"}],"repo":"https://github.com/dashbitco/nimble_zta","packageURL":"pkg:hex/nimble_zta","versions":[{"version":"0.1.2","lessThan":"0.1.3","versionType":"semver","status":"affected"}]},{"vendor":"dashbit","product":"nimble_zta","defaultStatus":"unaffected","collectionURL":"https://github.com","packageName":"dashbitco/nimble_zta","cpes":["cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*"],"modules":["'Elixir.NimbleZTA.Cloudflare'"],"programFiles":["lib/nimble_zta/cloudflare.ex"],"programRoutines":[{"name":"'Elixir.NimbleZTA.Cloudflare':authenticate/3"},{"name":"'Elixir.NimbleZTA.Cloudflare':verify_token/2"}],"repo":"https://github.com/dashbitco/nimble_zta","packageURL":"pkg:github/dashbitco/nimble_zta","versions":[{"version":"bc004b70985ae5763901baab3a4e204047899768","lessThan":"6458fd18a5ba41166d4973214c519e98fe05b72d","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:43:06.738544Z","id":"CVE-2026-91187","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-91187.html","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/dashbitco/nimble_zta/commit/6458fd18a5ba41166d4973214c519e98fe05b72d","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/dashbitco/nimble_zta/commit/bc004b70985ae5763901baab3a4e204047899768","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/dashbitco/nimble_zta/security/advisories/GHSA-rj24-g8cc-g7g2","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-91187","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}]}},{"cve":{"id":"CVE-2026-95519","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T14:18:20.153","lastModified":"2026-09-25T13:17:23.940","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/a:redhat:hummingbird:1"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T03:55:26.688738Z","id":"CVE-2026-95519","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-95519","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2470977","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-95521","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T14:18:20.290","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/a:redhat:hummingbird:1"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:01:31.439999Z","id":"CVE-2026-95521","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-95521","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537812","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-97057","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T14:18:21.683","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis endpoint can deliver a crafted RESP header with a length above 2^32-1 to crash the Node.js client process."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"NodeRedis","product":"redis-parser","defaultStatus":"unaffected","packageURL":"pkg:npm/redis-parser","versions":[{"version":"0","lessThanOrEqual":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:31:45.966419Z","id":"CVE-2026-97057","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1284"}]}],"references":[{"url":"https://github.com/NodeRedis/node-redis-parser","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NodeRedis/node-redis-parser/blob/4c2d31c8717f05dea1ffd91a0e45d68f452c73bd/lib/parser.js#L108-L122","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NodeRedis/node-redis-parser/blob/4c2d31c8717f05dea1ffd91a0e45d68f452c73bd/lib/parser.js#L212","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NodeRedis/node-redis-parser/blob/4c2d31c8717f05dea1ffd91a0e45d68f452c73bd/lib/parser.js#L492-L550","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NodeRedis/node-redis-parser/issues/47","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NodeRedis/node-redis-parser/issues/65","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/redis-parser-through-3.0.0-denial-of-service-via-invalid-array-length","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-97058","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T14:18:21.840","lastModified":"2026-10-16T15:10:00.103","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-97059","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T14:18:21.997","lastModified":"2026-09-30T21:17:19.180","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OFFIS","product":"DCMTK","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.7.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:38:56.115734Z","id":"CVE-2026-97059","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/DCMTK/dcmtk","source":"disclosure@vulncheck.com"},{"url":"https://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L334-L360","source":"disclosure@vulncheck.com"},{"url":"https://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L399-L430","source":"disclosure@vulncheck.com"},{"url":"https://github.com/DCMTK/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285","source":"disclosure@vulncheck.com"},{"url":"https://github.com/DCMTK/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1","source":"disclosure@vulncheck.com"},{"url":"https://support.dcmtk.org/redmine/issues/1281","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/dcmtk-through-3.7.0-heap-over-read-via-numberofframes","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-97061","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T14:18:22.160","lastModified":"2026-09-29T03:17:22.797","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters to retrieve playlist names belonging to other users without authorization."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"blackcandy-org","product":"Black Candy","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:46:16.467057Z","id":"CVE-2026-97061","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/blackcandy-org/blackcandy","source":"disclosure@vulncheck.com"},{"url":"https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/controllers/search/playlists_controller.rb#L5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/controllers/search_controller.rb#L9","source":"disclosure@vulncheck.com"},{"url":"https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/models/concerns/searchable_concern.rb#L21","source":"disclosure@vulncheck.com"},{"url":"https://github.com/blackcandy-org/blackcandy/issues/463","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/black-candy-through-3.2.1-information-disclosure-via-playlist-search","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-97062","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T14:18:22.317","lastModified":"2026-10-12T21:17:24.477","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Webkul","product":"Aureus ERP","defaultStatus":"unaffected","repo":"https://github.com/aureuserp/aureuserp","packageURL":"pkg:composer/aureuserp/aureuserp","versions":[{"version":"0","lessThanOrEqual":"1.6.0","versionType":"semver","status":"affected"},{"version":"53ad76dd566f414f1773ec6513616fc2b9e251b5","versionType":"git","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:57:04.998484Z","id":"CVE-2026-97062","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-97062","source":"disclosure@vulncheck.com"},{"url":"https://github.com/aureuserp/aureuserp/pull/1574","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/stored-xss-via-svg-upload-aureuserp","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/aureus-erp-stored-xss-via-svg-file-upload","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/stored-xss-via-svg-upload-aureuserp","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97359","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T14:18:22.533","lastModified":"2026-09-29T03:17:23.087","vulnStatus":"Deferred","cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to execute arbitrary commands on the underlying host system."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"rejetto","product":"hfs2","defaultStatus":"unaffected","repo":"https://github.com/rejetto/hfs2","packageURL":"pkg:github/rejetto/hfs2","versions":[{"version":"2.0.0","lessThanOrEqual":"2.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:44:32.969852Z","id":"CVE-2026-97359","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1336"}]}],"references":[{"url":"https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-upload-filename-template-injection/README.md","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/hfs2-rce-via-multipart-upload-filename-template-injection","source":"disclosure@vulncheck.com"},{"url":"https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-upload-filename-template-injection/README.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97360","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T14:18:22.703","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro dispatcher's lack of authorization model combined with the path resolver's failure to confine absolute paths to manipulate the template engine and compromise the confidentiality, integrity, and availability of the host."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"rejetto","product":"hfs2","defaultStatus":"unaffected","repo":"https://github.com/rejetto/hfs2","packageURL":"pkg:github/rejetto/hfs2","versions":[{"version":"2.0.0","lessThanOrEqual":"2.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:58:41.458904Z","id":"CVE-2026-97360","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-template-macro-missing-authorization/README.md","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/hfs2-unauthenticated-arbitrary-file-read-write-via-template-engine","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-12559","sourceIdentifier":"security@opentext.com","published":"2026-09-24T15:17:18.350","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting confidentiality and integrity of information processed through the application."}],"affected":[{"source":"security@opentext.com","affectedData":[{"vendor":"OpenText","product":"Vendor Invoice Management for SAP Solutions","defaultStatus":"unaffected","modules":["SAP Fiori Capture Validation application"],"platforms":["SAP Fiori"],"versions":[{"version":"VIM 7.6/20.4","lessThanOrEqual":"0009","versionType":"custom","status":"affected"},{"version":"VIM 23.4","lessThanOrEqual":"0004","versionType":"custom","status":"affected"},{"version":"VIM 25.4","lessThanOrEqual":"0001","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@opentext.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:M/U:Red","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"NO","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"RED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:51:19.732789Z","id":"CVE-2026-12559","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@opentext.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0869040","source":"security@opentext.com"},{"url":"https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0869044","source":"security@opentext.com"}]}},{"cve":{"id":"CVE-2026-13465","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:19.117","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:59:23.391487Z","id":"CVE-2026-13465","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-13466","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:19.280","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect calculation of buffer size vulnerability in Altera Trusted Firmware on HPS allows Overflow Buffers.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:59:42.934429Z","id":"CVE-2026-13466","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-131"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-13467","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:19.423","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:00:08.390526Z","id":"CVE-2026-13467","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-18870","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:20.270","lastModified":"2026-09-30T16:00:00.363","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"PowerVM Hypervisor","cpes":["cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3.0:*:*:*:*:*:*:*"],"versions":[{"version":"FW1120.00","lessThanOrEqual":"FW1120.01","versionType":"semver","status":"affected"},{"version":"FW1110.00","lessThanOrEqual":"FW1110.31","versionType":"semver","status":"affected"},{"version":"FW1060.00","lessThanOrEqual":"FW1060.81","versionType":"semver","status":"affected"},{"version":"FW950.00","lessThanOrEqual":"FW950.H3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:52:53.685284Z","id":"CVE-2026-18870","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"7EA43BB6-6776-4E2F-A279-E30E844EF1C2"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"EC2FA374-2ADB-45C1-ACA1-D39BAD709067"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"96C2DEDC-012D-4B9F-B9DF-344A49B67E46"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"F9475E71-FA18-43A1-902A-2E21C777D254"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"A66F38F0-55B5-444F-968D-718170852B0A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3F51514A-8E29-42D1-B874-838F8A0869D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"D11BE622-6276-49D9-B394-EB615E3C5BFD"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"E9E20EAA-BBEE-4924-9BBA-07D6DE018509"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"26E1E16B-8F95-46EC-BAA0-0A53F332292B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"B7048C65-6872-4F5B-9691-D74E269E1CF9"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"96EEE277-E80A-4380-A4C4-9E2CCF6E8C52"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8688E552-BE38-4EB9-8514-D7060C548C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"BB22063C-C9A0-4D69-95FC-3B19ACDC6B21"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"76154775-CAE7-43F1-A14D-CA092F5539D1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"82AEF0FF-068C-4123-BEFB-7D3584F1B15A"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"82BC7AD7-3F24-4EE7-9360-4024A6CC319C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"57896A45-2625-4C51-9B3E-5B934979FA33"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"4AB43439-0F5B-4839-A109-E14E726CAD27"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*","matchCriteriaId":"AC9D9EFF-1E92-4894-9976-001227F78869"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"F95F4E4A-7374-40FB-AC3B-AEF7AE607CEF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B3F5100A-FE2A-412C-9B57-B616B97B1142"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"D79F90A7-5929-4893-BC72-4CF11BDB4F9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*","matchCriteriaId":"EA825307-2083-4264-8E8B-798661285261"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1080_\\(9080-hex\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1681A01A-7020-427B-848A-6E3CC0FE1E5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1080_\\(9080-hex\\):-:*:*:*:*:*:*:*","matchCriteriaId":"DF85251B-E02C-4293-98F0-D331BF51CAC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"8E228E48-523F-4486-8A29-5DB61851B1F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"38AE73EA-12AE-4E46-8435-259AD1773403"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E49EE658-B8AE-48F7-A765-92BA3A630AA0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"DD0351D8-3E79-4A28-BC5E-ADD9551238BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"C5578070-8EEC-4A76-A07F-5094DCF69A49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"ECD54B80-5754-4C19-AE0C-F539DEF96DCB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7097B3B4-A5BF-4B60-8FAA-6D8D4BA1A44E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B2C09090-C18F-464A-8DEF-E23B5990E2A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1E9CBB70-ACFC-4904-8CFB-16D3672FE3CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"0170400B-89A7-4B44-9AA7-9A168C9CAE9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"CA91958A-CDF9-4360-8886-00E38A8B7366"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*","matchCriteriaId":"061D193E-84BC-4DE7-96C4-B75D11769ED5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7F1D438E-4AFC-4BAC-AD5B-B6152FFEA821"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"7BED85F2-8CCB-417C-A739-23828966A036"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"6A492561-E2C8-4EAE-8D31-F20DA413BABC"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"90F8D763-A95F-4189-82DB-1DD6B134D244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1180_\\(9080-heu\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s922_\\(9009-22g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"A7A29250-6BFF-4BFD-8723-A584F5AFDD67"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s922_\\(9009-22g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"95E5E77F-A5BB-46E7-B6B6-B02F242DE829"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h922_\\(9223-22s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"852BF98B-82A6-4A6A-9541-BB65A2CDF650"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h922_\\(9223-22s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E7851003-8D6B-4FE8-87D7-BE968E85E448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s914_\\(9009-41g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D71B426C-DDDF-4341-9A2E-6A36569A1839"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s914_\\(9009-41g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"003F591A-ACCD-497E-BF8A-DE090321D778"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s924_\\(9009-42g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"E0EDDB11-824F-4E4E-838C-2A5AE1A79C0C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s924_\\(9009-42g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"4038C5DB-DF9C-4661-9590-F6A0CD4D15D5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h924_\\(9223-42s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"2A4BBB63-0102-44F0-AF76-4245872B2F89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h924_\\(9223-42s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"C2F0E93A-26F0-4914-8A31-3C86E64D5B8A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e950_\\(9040-mr9\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D4A756BD-C31D-4457-8B50-305B32E92785"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e950_\\(9040-mr9\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9FF58E5C-0A54-4F2F-A426-0BFD1EACE991"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e980_\\(9080-m9s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"52CB0665-0AE6-4A6E-A629-8AB47C7837C5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e980_\\(9080-m9s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9BE56BD8-DB0F-4151-9428-42F1B6452D99"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289135","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-19492","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:20.553","lastModified":"2026-09-30T15:40:51.593","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in a hypervisor call interface. An attacker with root access to a guest partition can read a limited amount of hypervisor memory, potentially exposing sensitive data belonging to the hypervisor or other guest partitions hosted on the same system, resulting in a confidentiality impact. The attacker has no control over which memory contents are returned. This vulnerability is of particular concern in multi-tenant environments where guests may run arbitrary OS images."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"PowerVM Hypervisor","cpes":["cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81.0:*:*:*:*:*:*:*"],"versions":[{"version":"FW1120.00","lessThanOrEqual":"FW1120.01","versionType":"semver","status":"affected"},{"version":"FW1110.00","lessThanOrEqual":"FW1110.31","versionType":"semver","status":"affected"},{"version":"FW1060.00","lessThanOrEqual":"FW1060.81","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","baseScore":3.2,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.5,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:50:45.611946Z","id":"CVE-2026-19492","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-457"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"7EA43BB6-6776-4E2F-A279-E30E844EF1C2"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"EC2FA374-2ADB-45C1-ACA1-D39BAD709067"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"96C2DEDC-012D-4B9F-B9DF-344A49B67E46"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"F9475E71-FA18-43A1-902A-2E21C777D254"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"A66F38F0-55B5-444F-968D-718170852B0A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3F51514A-8E29-42D1-B874-838F8A0869D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"D11BE622-6276-49D9-B394-EB615E3C5BFD"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"E9E20EAA-BBEE-4924-9BBA-07D6DE018509"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"26E1E16B-8F95-46EC-BAA0-0A53F332292B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"B7048C65-6872-4F5B-9691-D74E269E1CF9"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"96EEE277-E80A-4380-A4C4-9E2CCF6E8C52"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8688E552-BE38-4EB9-8514-D7060C548C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"BB22063C-C9A0-4D69-95FC-3B19ACDC6B21"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"76154775-CAE7-43F1-A14D-CA092F5539D1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"82AEF0FF-068C-4123-BEFB-7D3584F1B15A"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"82BC7AD7-3F24-4EE7-9360-4024A6CC319C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"57896A45-2625-4C51-9B3E-5B934979FA33"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"4AB43439-0F5B-4839-A109-E14E726CAD27"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*","matchCriteriaId":"AC9D9EFF-1E92-4894-9976-001227F78869"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"F95F4E4A-7374-40FB-AC3B-AEF7AE607CEF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B3F5100A-FE2A-412C-9B57-B616B97B1142"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"D79F90A7-5929-4893-BC72-4CF11BDB4F9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*","matchCriteriaId":"EA825307-2083-4264-8E8B-798661285261"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1080_\\(9080-hex\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1681A01A-7020-427B-848A-6E3CC0FE1E5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1080_\\(9080-hex\\):-:*:*:*:*:*:*:*","matchCriteriaId":"DF85251B-E02C-4293-98F0-D331BF51CAC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"8E228E48-523F-4486-8A29-5DB61851B1F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"38AE73EA-12AE-4E46-8435-259AD1773403"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E49EE658-B8AE-48F7-A765-92BA3A630AA0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"DD0351D8-3E79-4A28-BC5E-ADD9551238BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"C5578070-8EEC-4A76-A07F-5094DCF69A49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"ECD54B80-5754-4C19-AE0C-F539DEF96DCB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7097B3B4-A5BF-4B60-8FAA-6D8D4BA1A44E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B2C09090-C18F-464A-8DEF-E23B5990E2A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1E9CBB70-ACFC-4904-8CFB-16D3672FE3CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"0170400B-89A7-4B44-9AA7-9A168C9CAE9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"CA91958A-CDF9-4360-8886-00E38A8B7366"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*","matchCriteriaId":"061D193E-84BC-4DE7-96C4-B75D11769ED5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7F1D438E-4AFC-4BAC-AD5B-B6152FFEA821"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"7BED85F2-8CCB-417C-A739-23828966A036"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"6A492561-E2C8-4EAE-8D31-F20DA413BABC"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"90F8D763-A95F-4189-82DB-1DD6B134D244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1180_\\(9080-heu\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289137","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-51994","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:22.947","lastModified":"2026-09-25T19:17:26.853","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:11:53.566976Z","id":"CVE-2026-51994","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/geelen/mcp-remote","source":"cve@mitre.org"},{"url":"https://github.com/geelen/mcp-remote/security/advisories","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security#readme","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security/blob/v1.0.1/advisories/F-01-resource-metadata-ssrf.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-51995","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:23.087","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:57:59.281035Z","id":"CVE-2026-51995","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/geelen/mcp-remote","source":"cve@mitre.org"},{"url":"https://github.com/geelen/mcp-remote/security/advisories","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security#readme","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security/blob/v1.0.1/advisories/F-02-authorization-server-ssrf.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-51996","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:23.280","lastModified":"2026-09-29T16:17:08.197","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:22:07.273180Z","id":"CVE-2026-51996","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-328"}]}],"references":[{"url":"https://github.com/geelen/mcp-remote","source":"cve@mitre.org"},{"url":"https://github.com/geelen/mcp-remote/security/advisories","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security/blob/v1.0.1/advisories/F-04-md5-token-isolation.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-51997","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:23.397","lastModified":"2026-09-25T17:17:09.083","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:30:01.121484Z","id":"CVE-2026-51997","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/geelen/mcp-remote","source":"cve@mitre.org"},{"url":"https://github.com/geelen/mcp-remote/security/advisories","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security/blob/v1.0.1/advisories/F-08-browser-url-validation.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-52001","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:23.520","lastModified":"2026-10-06T18:16:55.273","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper \" src/lib/utils.ts"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:46:05.813178Z","id":"CVE-2026-52001","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/geelen/mcp-remote","source":"cve@mitre.org"},{"url":"https://github.com/geelen/mcp-remote/security/advisories","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security#readme","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security/blob/v1.0.1/advisories/F-11-sse-token-origin-scope.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-56736","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T15:17:24.100","lastModified":"2026-09-24T15:17:24.240","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user (or low-privileged registered user) to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeover via session theft. The vulnerability exists because `html_entity_decode()` converts HTML entities into executable HTML after `strip_tags()` has already passed them through, and the admin template renders the content with Twig's `|raw` filter without any output sanitization. Version 4.2.0-alpha fixes the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"version":"< 4.2.0-alpha","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:51:56.083267Z","id":"CVE-2026-56736","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgwp-vc7q-cvj3","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgwp-vc7q-cvj3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-58004","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:24.610","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:00:27.350128Z","id":"CVE-2026-58004","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-58005","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:24.750","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:00:45.663087Z","id":"CVE-2026-58005","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-58006","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:24.890","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:01:00.684169Z","id":"CVE-2026-58006","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-822"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-58007","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:25.027","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:01:18.588125Z","id":"CVE-2026-58007","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-822"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-58008","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:25.163","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:01:39.463181Z","id":"CVE-2026-58008","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-65422","sourceIdentifier":"security@genetec.com","published":"2026-09-24T15:17:27.960","lastModified":"2026-09-24T19:37:47.987","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails."}],"affected":[{"source":"security@genetec.com","affectedData":[{"vendor":"Genetec Inc.","product":"Genetec Security Center","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"<5.12.2.22","versionType":"semver","status":"affected"},{"version":">=5.12.2.22","versionType":"semver","status":"unaffected"},{"version":"<5.13.3.9","versionType":"semver","status":"affected"},{"version":">=5.13.3.9","versionType":"semver","status":"unaffected"},{"version":"<5.14.1.2","versionType":"semver","status":"affected"},{"version":">=5.14.1.2","versionType":"semver","status":"unaffected"},{"version":">=5.14.2.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@genetec.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:54:16.470446Z","id":"CVE-2026-65422","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@genetec.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://techdocs.genetec.com/r/en-US/Security-Updates-for-Security-Center-5.14/Resolved-vulnerabilities-in-Security-Center-5.14.1.2","source":"security@genetec.com"}]}},{"cve":{"id":"CVE-2026-6544","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:30.890","lastModified":"2026-09-28T20:48:40.993","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary files and increased attack surface."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Concert","cpes":["cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:49:31.088220Z","id":"CVE-2026-6544","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-552"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndIncluding":"3.0.0","matchCriteriaId":"F935EDBC-29BC-4CEB-8149-DD294B37307D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288830","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-73064","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:34.273","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"trustedfirmware","product":"Mbed TLS","defaultStatus":"unaffected","repo":"https://github.com/Mbed-TLS/mbedtls","versions":[{"version":"3.2.0","lessThan":"3.6.7","versionType":"semver","status":"affected"},{"version":"4.0.0","lessThan":"4.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":2.9,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.4,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:00:13.513498Z","id":"CVE-2026-73064","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-394"}]}],"references":[{"url":"https://github.com/Mbed-TLS/mbedtls","source":"cve@mitre.org"},{"url":"https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity/","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-77703","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-24T15:17:37.800","lastModified":"2026-09-24T19:36:51.280","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Key exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM).\n\nThis issue affects Liman Render Engine: from 1.0 before 1.2-75."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"HAVELSAN Inc.","product":"Liman Render Engine","defaultStatus":"unaffected","versions":[{"version":"1.0","lessThan":"1.2-75","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:53:46.625817Z","id":"CVE-2026-77703","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Primary","description":[{"lang":"en","value":"CWE-322"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1172","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-77707","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-24T15:17:37.947","lastModified":"2026-09-24T19:36:51.280","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper certificate validation vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM).\n\nThis issue affects Liman Render Engine: from 1.0 before 1.2-75."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"HAVELSAN Inc.","product":"Liman Render Engine","defaultStatus":"unaffected","versions":[{"version":"1.0","lessThan":"1.2-75","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:58:34.805701Z","id":"CVE-2026-77707","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Primary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1172","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-77825","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:38.560","lastModified":"2026-09-29T13:26:00.887","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint (`GET /v1/admin/logs/file`). The path confinement check uses `str.startswith()` rather than proper boundary validation, allowing an authenticated admin to read `.log`, `.jsonl`, and `.json` files outside the configured `LOG_FOLDER` by supplying a filename that resolves into a sibling directory whose absolute path shares the log directory's string prefix."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"ContextForge MCP Gateway","cpes":["cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.8:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.0.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:40:15.788728Z","id":"CVE-2026-77825","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:contextforge:*:*:*:*:*:python:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.0.9","matchCriteriaId":"0E3A0CD6-073C-41C6-BCED-745C13F56E6F"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289314","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-77874","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:38.700","lastModified":"2026-09-24T19:41:16.513","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Enterprise Build of Quarkus","cpes":["cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5.sp1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5.sp1:sp1:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3.sp1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3.sp1:sp1:*:*:*:*:*:*"],"versions":[{"version":"3.27.1","lessThanOrEqual":"3.27.5.SP1","versionType":"semver","status":"affected"},{"version":"3.33.1","lessThanOrEqual":"3.33.3.SP1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:50:50.894476Z","id":"CVE-2026-77874","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289050","source":"psirt@us.ibm.com"}]}},{"cve":{"id":"CVE-2026-81539","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:39.377","lastModified":"2026-10-06T16:13:00.500","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:52:47.193272Z","id":"CVE-2026-81539","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-81545","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:39.517","lastModified":"2026-10-06T16:12:58.357","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:52:29.473881Z","id":"CVE-2026-81545","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-81547","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:39.650","lastModified":"2026-10-06T16:12:56.070","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:48:38.039296Z","id":"CVE-2026-81547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-81548","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:39.770","lastModified":"2026-10-06T16:20:11.740","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:40:22.446545Z","id":"CVE-2026-81548","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-81549","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:39.897","lastModified":"2026-10-06T16:19:54.677","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:20:22.120549Z","id":"CVE-2026-81549","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-81552","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:40.020","lastModified":"2026-10-06T16:16:11.680","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:52:39.611498Z","id":"CVE-2026-81552","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-82093","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:40.733","lastModified":"2026-10-06T16:15:46.710","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:54:51.145401Z","id":"CVE-2026-82093","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-82094","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:40.870","lastModified":"2026-10-06T16:15:27.447","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":4.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:47:12.811707Z","id":"CVE-2026-82094","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-88351","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:50.423","lastModified":"2026-09-25T18:17:31.257","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size calculation in mpack_tree_parse_children() can overflow size_t and produce an undersized allocation. Subsequent parsing writes mpack_node_data_t records beyond the allocated heap buffer, resulting in heap-buffer-overflow, memory corruption, and denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:09:19.298466Z","id":"CVE-2026-88351","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b","source":"cve@mitre.org"},{"url":"https://github.com/ludocode/mpack/issues/123","source":"cve@mitre.org"},{"url":"https://github.com/ludocode/mpack/issues/123","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-90481","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:51.760","lastModified":"2026-09-24T21:08:22.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"PortSwigger","product":"Burp Suite DAST","defaultStatus":"unaffected","versions":[{"version":"2021.11","lessThan":"2026.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:55:22.193962Z","id":"CVE-2026-90481","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Primary","description":[{"lang":"en","value":"CWE-288"}]}],"references":[{"url":"https://portswigger.net/burp/releases/dast-2026-8","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-90959","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T15:17:53.540","lastModified":"2026-10-21T19:17:04.337","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader. An authenticated user with low-privilege repository permissions can supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation allows an attacker to read the container registry token signing private key and forge bearer tokens, granting unauthorized access to all private container repositories in the affected registry."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.12-pulpcore","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:3.49.71-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/hub-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1791947385","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/hub-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1792388670","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-24/hub-rhel8","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-25/hub-rhel8","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pulpcore-selinux","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.11-pulpcore","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3x-pulpcore","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pulpcore-obsolete-packages","cpes":["cpe:/a:redhat:satellite:6"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pulpcore-selinux","cpes":["cpe:/a:redhat:satellite:6"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.12-pulpcore","cpes":["cpe:/a:redhat:satellite:6"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","cpes":["cpe:/a:redhat:satellite:6"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rubygem-pulpcore_client","cpes":["cpe:/a:redhat:satellite:6"]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 4 for Cloud Providers","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pulpcore-selinux","cpes":["cpe:/a:redhat:rhui:4::el8"]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 4 for Cloud Providers","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","cpes":["cpe:/a:redhat:rhui:4::el8"]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 4 for Cloud Providers","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore-client","cpes":["cpe:/a:redhat:rhui:4::el8"]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 5","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore-client","cpes":["cpe:/a:redhat:rhui:5::el9"]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhui5/rhua-rhel9","cpes":["cpe:/a:redhat:rhui:5::el9"]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 5","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhui5/rhua-tp-rhel9","cpes":["cpe:/a:redhat:rhui:5::el9"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:47:33.555341Z","id":"CVE-2026-90959","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:87004","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:87120","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:87124","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-90959","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533037","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-97224","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T15:18:01.227","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in Excalidraw up to 0.18.1. The impacted element is an unknown function of the file packages/excalidraw/data/restore.ts of the component Imported File Handler. Performing a manipulation of the argument customData.generationData.html results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"Excalidraw","cpes":["cpe:2.3:a:excalidraw:excalidraw:*:*:*:*:*:*:*:*"],"modules":["Imported File Handler"],"versions":[{"version":"0.18.0","status":"affected"},{"version":"0.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:31:36.209421Z","id":"CVE-2026-97224","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97224","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/907811","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409318","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409318/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97362","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T15:18:01.393","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire file server unresponsive to all clients without self-recovery until an operator manually restarts the service."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"rejetto","product":"hfs2","defaultStatus":"unaffected","repo":"https://github.com/rejetto/hfs2","packageURL":"pkg:github/rejetto/hfs2","versions":[{"version":"2.0.0","lessThanOrEqual":"2.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:32:26.283903Z","id":"CVE-2026-97362","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"references":[{"url":"https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-getini-infinite-loop-dos/README.md","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/hfs2-unauthenticated-denial-of-service-via-hung-serving-thread","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-97404","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:18:01.537","lastModified":"2026-09-26T23:16:43.187","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in the ability to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"OpenStack","product":"Zaqar","defaultStatus":"unaffected","repo":"https://opendev.org/openstack/zaqar","versions":[{"version":"1.0.0","lessThan":"20.1.2","versionType":"semver","status":"affected"},{"version":"21.0.0","lessThan":"21.0.2","versionType":"semver","status":"affected"},{"version":"22.0.0","lessThan":"22.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:40:41.633493Z","id":"CVE-2026-97404","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-348"}]}],"references":[{"url":"https://launchpad.net/bugs/2164987","source":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/6","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2025-32000","sourceIdentifier":"psirt@hcl.com","published":"2026-09-24T16:17:06.087","lastModified":"2026-10-14T13:10:00.187","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability."},{"lang":"es","value":"HCL Sametime es vulnerable a la sanitización de entrada insuficiente. La aplicación no sanitizaba adecuadamente la entrada del usuario. Cuando la entrada del usuario se confía implícita o explícitamente sin suficiente sanitización, actores maliciosos pueden explotar esta vulnerabilidad."}],"affected":[{"source":"psirt@hcl.com","affectedData":[{"vendor":"HCL Software","product":"HCL Sametime","defaultStatus":"unaffected","versions":[{"version":"12.0.33 and older","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@hcl.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:35:48.370418Z","id":"CVE-2025-32000","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@hcl.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132652","source":"psirt@hcl.com"}]}},{"cve":{"id":"CVE-2026-56737","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:07.637","lastModified":"2026-09-29T03:17:16.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without first authenticating with the account password, allowing takeover of any 2FA-enabled account, including administrator accounts. Version 4.1.6 is patched by binding TOTP verification to a session established after successful password authentication and limiting failed TOTP attempts. No official workaround is documented; affected installations should upgrade to 4.1.6 or later."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"version":">= 3.2.0, < 4.1.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:47:07.965759Z","id":"CVE-2026-56737","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/commit/410208b90f1d01534812ac5203d3e8d9c7bd591f","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/commit/5097dff341fb01e93e8561e7261b3ae657df715a","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/commit/6a69f6e2142fde722165c65b7e0a49f3176e87be","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8gpw-xvpf-hvx5","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8gpw-xvpf-hvx5","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-56739","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:07.803","lastModified":"2026-09-28T21:17:18.067","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.43.0, Logto fetches administrator-controlled outbound destinations without validating the address used for the connection. Webhook delivery in packages/core/src/libraries/hook/utils.ts can reach special-use and cloud metadata addresses. Custom OAuth2 connectors can use an attacker-selected userInfoEndpoint and forward the OAuth access token in the Authorization header, while OIDC connectors can fetch an attacker-selected jwksUri. The affected operations require tenant administrative configuration access, but they cross the server's network boundary and can expose internal data or upstream provider credentials. This issue is fixed in version 1.43.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"logto-io","product":"logto","versions":[{"version":"< 1.43.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T20:11:08.681205Z","id":"CVE-2026-56739","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26","source":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/pull/9501","source":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.43.0","source":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/security/advisories/GHSA-3556-624q-c5w3","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-63203","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:08.700","lastModified":"2026-09-24T16:17:08.837","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterprise SSO provider access tokens through GET /api/my-account/identities/{target}/access-token or GET /api/my-account/sso-identities/{connectorId}/access-token. The handlers authenticate the user but do not require the identities scope that protects neighboring identity-detail operations, bypassing the intended Account API consent boundary. Exploitation requires federated token-set storage to be enabled and the affected user to have authenticated through a supported connector. A low-trust application can use the disclosed provider token against upstream APIs within that token's granted scopes. This issue is fixed in version 1.42.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"logto-io","product":"logto","versions":[{"version":">= 1.31.0, < 1.42.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:47:15.549514Z","id":"CVE-2026-63203","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/logto-io/logto/commit/b560d17a4da4c25da95e3c73af4485d18ab7c224","source":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/pull/9116","source":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.42.0","source":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/security/advisories/GHSA-6g9q-qrx7-3jxf","source":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/security/advisories/GHSA-6g9q-qrx7-3jxf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-63630","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:08.873","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf() sends an RFC 3161 TimeStampReq containing the PDF's SHA-256 MessageImprint to the attacker-selected endpoint. The default self-hosted configuration does not set VITE_CORS_PROXY_URL, so the request bypasses the proxy's ALLOWED_TSA_HOSTS checks and is sent directly. The disclosed digest can confirm that a document matches a known file and can correlate the same document across users without revealing its contents. This vulnerability is fixed in 2.8.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"alam00000","product":"bentopdf","versions":[{"version":"< 2.8.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":3.4,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:48:51.526364Z","id":"CVE-2026-63630","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"},{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/alam00000/bentopdf/commit/b21f602cca972320bfffbf72e37df535313a6e48","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/releases/tag/v2.8.7","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/security/advisories/GHSA-cx8x-7rrr-r9x8","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/security/advisories/GHSA-cx8x-7rrr-r9x8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-67233","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:09.520","lastModified":"2026-10-19T19:36:12.260","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's is_authorized/2 delegates to rabbit_mgmt_util:is_authorized_monitor/2, which accepts the monitoring tag. But allowed_methods includes DELETE, and delete_resource/2 deletes / restarts shovel runtime parameters with no additional role check. A monitoring user , intended to have read-only visibility , can therefore delete or restart any shovel in any vhost they can see. A read-only monitoring user can delete or restart any dynamic shovel , a state-changing operation that the equivalent /api/parameters endpoint correctly restricts to policymaker. Preconditions include rabbitmq_shovel + rabbitmq_shovel_management plugins enabled Attacker has credentials with the monitoring tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"},{"version":">= 4.3.0, < 4.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:12.181651Z","id":"CVE-2026-67233","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.1","matchCriteriaId":"41410FDE-4B5E-4466-B7C4-A62FEBFA0C80"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-7jc3-73v6-rjvc","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-75907","sourceIdentifier":"cret@cert.org","published":"2026-09-24T16:17:10.387","lastModified":"2026-09-28T16:31:16.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on the UID of the NTAG212 NFC chip alone is identification, not authentication, and the credential has no challenge-response capability that would resist copying."}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"Norwegian Cruise Line","product":"door access control","versions":[{"version":"N/A","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:01:05.357661Z","id":"CVE-2026-75907","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-294"},{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://kb.cert.org/vuls/id/676317","source":"cret@cert.org"},{"url":"https://www.kb.cert.org/vuls/id/676317","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-76907","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:10.500","lastModified":"2026-10-05T16:17:16.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated caller can submit an empty search query and iterate predictable path values to enumerate public document subtrees, obtaining document identifiers, titles, creator data, timestamps, and tree metadata. Each disclosed identifier can then be used through normal public-document endpoints to retrieve the document content, and differing 403 Forbidden and 404 Not Found responses reveal whether a guessed path exists. Authenticated users can similarly discover documents with authenticated link reach, while restricted documents remain protected. This issue is fixed in version 5.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"suitenumerique","product":"docs","versions":[{"version":">= 4.8.2, < 5.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:51:06.072038Z","id":"CVE-2026-76907","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/suitenumerique/docs/commit/9ef4a15f5e7437c73ad04d2115a15dba3ffb7a76","source":"security-advisories@github.com"},{"url":"https://github.com/suitenumerique/docs/releases/tag/v5.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/suitenumerique/docs/security/advisories/GHSA-p8v2-wjj3-3j9w","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-77581","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:10.943","lastModified":"2026-09-29T19:07:47.037","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js uses isPrivateOrReservedHost() to validate a supplied hostname separately from the DNS resolution used by fetch(targetUrl), allowing an attacker-controlled hostname to resolve to an internal or reserved destination after validation. A certificate-like path can satisfy ALLOWED_PATH_PATTERNS, and direct clients can forge the browser-oriented Origin header. Deployments without PROXY_SECRET skip the optional signature check, while the signature is an anti-abuse measure rather than a destination-security boundary. The proxy has a 10 MB response limit and can relay response bodies from reachable destinations. The advisory identifies both the official Worker deployment and self-hosted instances as impacted where the Worker execution environment can reach internal or reserved destinations. This vulnerability is fixed in 2.8.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"alam00000","product":"bentopdf","versions":[{"version":"< 2.8.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:37:09.697885Z","id":"CVE-2026-77581","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/alam00000/bentopdf/commit/45496fcd2ed6e02dcdde0d3839cc5024c091760c","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/commit/58cd1a8893bfe06e4a59a72adc2e7db00a8b9266","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/releases/tag/v2.8.7","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/security/advisories/GHSA-5xjf-rr5x-pcfj","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/security/advisories/GHSA-5xjf-rr5x-pcfj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-79758","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:11.107","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET /status/:id accepts an attacker-supplied numeric host identifier, and POST /clear-connections permits a regular user to clear the global SSH connection pool. The affected src/backend/ssh/server-stats.ts routes expose host online or offline state and lastChecked timestamps and can disrupt other users' active sessions or pooled connections. Unauthenticated requests remain blocked, but authentication alone does not preserve tenant isolation. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 1.8.0, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:20:25.319540Z","id":"CVE-2026-79758","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-372w-6f3h-vcm4","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-372w-6f3h-vcm4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-79759","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:11.283","lastModified":"2026-09-29T03:17:18.063","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values without checking that either record belongs to the requesting user. In src/backend/database/routes/credentials.ts, differential errors reveal whether credential and host records exist and disclose each record's authType value. Properly encrypted passwords and keys are not disclosed, but a key-authenticated victim host can receive an outbound SSH connection attempt using the attacker's public key. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 1.7.0, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:50:06.888547Z","id":"CVE-2026-79759","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/b0598294a6aeed866f51ce58067f43c1d751c7a6","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-w4cf-69fj-g96f","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/security/advisories/GHSA-cx8x-7rrr-r9x8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-79760","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:11.490","lastModified":"2026-09-28T16:17:15.077","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests through the notification-channel test endpoint. The request path in src/backend/database/routes/alert-rules-routes.ts reaches src/backend/utils/notification-sender.ts without destination allowlisting or private-address blocking. This permits blind requests to internal HTTP services reachable by the Termix server. Webhook mode also permits attacker-controlled HTTP methods and headers, which can cause limited state changes when an internal service accepts the fixed notification body, although response bodies are not returned. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 2.5.0, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T15:43:26.193088Z","id":"CVE-2026-79760","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/commit/e1d1a3e53d65794ec2f23099bafe77fdfdd11648","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-6hx3-9mgq-h9fj","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-79761","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:11.743","lastModified":"2026-10-05T16:17:16.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on the selected target host. In src/backend/database/routes/credential-deploy-routes.ts, both grep -F verification paths accept command substitution or quote-breaking shell syntax in keyPattern. An authenticated user who can deploy a crafted SSH credential can therefore execute commands with the selected remote account's privileges. The separate ACME command-injection report is outside this CVE's scope. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 1.7.0, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:10.792630Z","id":"CVE-2026-79761","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/commit/fafff94e5e31c3843df06aa08773bbaa879bbede","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-p2g3-2xq3-23gx","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-88355","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:12.833","lastModified":"2026-10-06T18:16:57.013","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr(). For arity-0 expression nodes, including constants, variables, and zero-argument functions, the function allocates less memory than sizeof(te_expr) but treats the returned allocation as a complete te_expr object. This results in undefined behavior and can cause deterministic process termination in UBSan-instrumented builds."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:44:34.584065Z","id":"CVE-2026-88355","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-131"}]}],"references":[{"url":"https://github.com/codeplea/tinyexpr/issues/145","source":"cve@mitre.org"},{"url":"https://github.com/szaydel/tinyexpr/commit/fe7459728c2ab8d2f91365abe56601cdd0e24f9b","source":"cve@mitre.org"},{"url":"https://github.com/codeplea/tinyexpr/issues/145","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88357","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:12.957","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16_t or wider integer pointers and directly dereferenced without alignment checks. This results in undefined behavior and can cause process termination in UBSan-instrumented builds or on strict-alignment architectures, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:52:11.193406Z","id":"CVE-2026-88357","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-1335"}]}],"references":[{"url":"https://github.com/ntop/nDPI/issues/3213","source":"cve@mitre.org"},{"url":"https://github.com/ntop/nDPI/pull/3231","source":"cve@mitre.org"},{"url":"https://github.com/utoni/nDPI/commit/6698f14bf6025394a537fe23f413cf79e9d13594","source":"cve@mitre.org"},{"url":"https://github.com/utoni/nDPI/commit/694231bb43ff21f452fbc2b53fcf6cdc9a99f75f","source":"cve@mitre.org"},{"url":"https://github.com/utoni/nDPI/commit/6ce1280c52ed52a97332c3fe58fd2b47b867ec6e","source":"cve@mitre.org"},{"url":"https://github.com/utoni/nDPI/commit/8fc3b439920021a77165f8aee4f81b25bc88629e","source":"cve@mitre.org"},{"url":"https://github.com/ntop/nDPI/issues/3213","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88358","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.090","lastModified":"2026-09-29T03:17:19.610","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause json_iterator::walk_document() to access buf[len] after the input buffer has been exhausted. This results in a heap out-of-bounds read and may cause application termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:25:09.093346Z","id":"CVE-2026-88358","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/simdjson/simdjson/commit/20b28712ffce8320237b75a587d35a2e89140577","source":"cve@mitre.org"},{"url":"https://github.com/simdjson/simdjson/issues/2815","source":"cve@mitre.org"},{"url":"https://github.com/simdjson/simdjson/pull/2817","source":"cve@mitre.org"},{"url":"https://github.com/simdjson/simdjson/issues/2815","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88361","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.217","lastModified":"2026-09-25T18:17:31.423","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:05:40.308342Z","id":"CVE-2026-88361","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/chenjiefeng2001/sumatrapdf_folked/commit/b22a8c71ddc9de80ece5f88d14b434c20fee912e","source":"cve@mitre.org"},{"url":"https://github.com/haimag/sumatrapdf/commit/8b999ff1bf0a8df244e75440682a3fd9a038eb2d","source":"cve@mitre.org"},{"url":"https://github.com/sumatrapdfreader/sumatrapdf/issues/5952","source":"cve@mitre.org"},{"url":"https://github.com/sumatrapdfreader/sumatrapdf/issues/5952","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88362","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.350","lastModified":"2026-09-25T17:17:17.660","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. This results in undefined behavior and can cause process termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:15:23.278438Z","id":"CVE-2026-88362","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-681"}]}],"references":[{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=709636","source":"cve@mitre.org"},{"url":"https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mujs.git/commit/?id=8a32c397b28fe45747ac4e9e4f3dca049825eda7","source":"cve@mitre.org"},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=709636","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88365","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.483","lastModified":"2026-09-29T03:17:20.747","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:27:31.703206Z","id":"CVE-2026-88365","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/lieff/minimp3/issues/151","source":"cve@mitre.org"},{"url":"https://github.com/lieff/minimp3/issues/151","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88366","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.607","lastModified":"2026-10-06T18:16:57.353","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands. A specially crafted SVG document containing extreme arc radius values can cause intermediate arc calculations to produce a NaN delta angle. The function subsequently converts this NaN value to int without validating that it is finite and representable, resulting in undefined behavior and process termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:43:32.241424Z","id":"CVE-2026-88366","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-681"}]}],"references":[{"url":"https://github.com/memononen/nanosvg/issues/294","source":"cve@mitre.org"},{"url":"https://github.com/memononen/nanosvg/issues/294","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88368","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.730","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int. The rasterizer subsequently converts these values to int without range validation, resulting in undefined behavior and possible process termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:54:43.282407Z","id":"CVE-2026-88368","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-681"}]}],"references":[{"url":"https://github.com/memononen/nanosvg/issues/292","source":"cve@mitre.org"},{"url":"https://github.com/memononen/nanosvg/issues/292","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88369","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.850","lastModified":"2026-09-25T18:17:31.773","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump()."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:00:10.265493Z","id":"CVE-2026-88369","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/zserge/jsmn/issues/249","source":"cve@mitre.org"},{"url":"https://github.com/zserge/jsmn/issues/249","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88370","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.977","lastModified":"2026-09-25T16:17:29.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache(). The bundled utility allocates exactly ini_length bytes, while strip_ini_cache() unconditionally writes a NUL terminator at ini_source[ini_length], requiring an additional writable byte. Applications using the bundled allocation pattern can trigger deterministic heap memory corruption when processing any non-empty INI input, resulting in denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:31:19.915848Z","id":"CVE-2026-88370","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://github.com/madmurphy/libconfini/issues/20","source":"cve@mitre.org"},{"url":"https://github.com/madmurphy/libconfini/issues/20","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88371","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:14.100","lastModified":"2026-10-06T18:16:57.523","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted Code 128 input, decode_e() can return -1 for an invalid edge pattern, and decode6() subsequently left-shifts this negative signed value while constructing the edge signature. The operation invokes undefined behavior and can terminate trap-mode UBSan builds with SIGILL, resulting in denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:41:48.800706Z","id":"CVE-2026-88371","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-682"}]}],"references":[{"url":"https://github.com/mchehab/zbar/issues/336","source":"cve@mitre.org"},{"url":"https://github.com/mchehab/zbar/issues/336","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-92680","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-24T16:17:14.357","lastModified":"2026-09-26T23:16:39.217","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target user has stored in Merge."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Araxis","product":"Merge","defaultStatus":"unknown","versions":[{"version":"2011.4074","lessThan":"2026.1","versionType":"custom","status":"affected"},{"version":"2026.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"timestamp":"2026-09-16T17:36:45.331736Z","id":"CVE-2026-92680","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:40:54.710486Z","id":"CVE-2026-92680","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-522"}]}],"references":[{"url":"https://github.com/grepstrength/CVE-2026-92680","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://grepstrength.com/research/araxis-merge","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-267-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://www.araxis.com/merge/release-notes-2026#Merge-SA-26-00","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92680","source":"9119a7d8-5eab-497f-8521-727c672e3725"}]}},{"cve":{"id":"CVE-2026-93205","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:14.523","lastModified":"2026-10-21T13:21:04.227","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu-v3: Manage teardown with devm\n\narm_smmu_device_remove() manually frees the IOPF queue, destroys the\nvmid_map and disables the device, while the IRQs and queues are devm\nmanaged. devm unwinds only after remove() returns, so the cleanup runs\nin the wrong order. The IOPF queue is freed before the event-queue IRQ\nwhose handler uses it.\n\nManage all of it with devm so the unwind order is correct. Free the IOPF\nqueue and vmid_map via devm actions, and disable the device from one\nregistered after arm_smmu_device_reset().\n\nThis is also a prerequisite for fixing a Tegra241 CMDQV CMD_SYNC\nuse-after-free in the subsequent patch."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"395ad89d11fd93f79a6b942e91fc409807a63c4b","lessThan":"64b1a9384db9cabf1bde378a2d5c1923fd67ea0d","versionType":"git","status":"affected"},{"version":"395ad89d11fd93f79a6b942e91fc409807a63c4b","lessThan":"981686f4137760a16a03c5193f11d85133533f93","versionType":"git","status":"affected"},{"version":"395ad89d11fd93f79a6b942e91fc409807a63c4b","lessThan":"2235eafda9b3df9295efd0593cd4a8977440c3f6","versionType":"git","status":"affected"},{"version":"395ad89d11fd93f79a6b942e91fc409807a63c4b","lessThan":"78fd5a2d65f3546cb4285f8e52f445baecbd00e0","versionType":"git","status":"affected"},{"version":"395ad89d11fd93f79a6b942e91fc409807a63c4b","lessThan":"2bd22a0d40503a65d243b011de146603c8ce1cbc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2235eafda9b3df9295efd0593cd4a8977440c3f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2bd22a0d40503a65d243b011de146603c8ce1cbc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64b1a9384db9cabf1bde378a2d5c1923fd67ea0d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78fd5a2d65f3546cb4285f8e52f445baecbd00e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/981686f4137760a16a03c5193f11d85133533f93","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93206","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:14.670","lastModified":"2026-10-19T10:17:11.367","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/proc: Use file_ns_capable() when checking config space read access\n\nproc_bus_pci_read() decides how much of the config space is readable based\non capable(CAP_SYS_ADMIN), which checks the credentials of the task calling\nread(), not the credentials of the process that opened the file.\n\nThe sysfs equivalent, pci_read_config(), has checked the credentials of the\nopening process since commit de139a339395 (\"pci: check caps from sysfs file\nopen to read device dependent config space\"), so a privileged process can\nopen the config space file and pass the file descriptor to an unprivileged\nprocess (for example, a process running a KVM guest with an assigned\ndevice), which can then read the entire config space.  The check was\nsubsequently routed through the LSM framework in commit 47970b1b2aa6 (\"pci:\nuse security_capable() when checking capablities during config space read\")\nand converted to the dedicated helper in commit ab0fa82b2df9 (\"pci-sysfs:\nuse proper file capability helper function\").\n\nThus, the two interfaces check the same capability against different\ncredentials.  Checking the credentials of the task calling read() makes the\noutcome depend on who reads rather than who opened, so the restriction is\nbypassed whenever a more privileged process reads through the descriptor.\nChecking the credentials recorded in file->f_cred settles the decision at\nopen() time and ties it to the file, where it cannot change with the\ncaller.\n\nUse file_ns_capable() to check CAP_SYS_ADMIN against the credentials in\neffect when the file was opened, bringing the procfs interface in line with\nthe sysfs behaviour.\n\nAs a result, a file descriptor opened by a privileged process and passed to\nan unprivileged one now allows the entire config space to be read through\nprocfs, matching sysfs."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8a3a54aa3e65ed76f8560a387243a7738ae0cb1c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5c7ab4ca66f0880cffc3735555ea719dd5253726","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"53407535d49ec034e476121020b5c878f0d92e18","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e7730acd6a01c5931a3afb83639810ff2fb9cc92","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"77272b7fd0e472086fd626a1fcd11da625822cc2","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c2d4174f492458ecdcdef309243624999612d526","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6351e94076329dab517ea94c115e15c4d8459381","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f82f53e75eff382fc8f56b73279b54f7cf5a5c65","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/53407535d49ec034e476121020b5c878f0d92e18","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c7ab4ca66f0880cffc3735555ea719dd5253726","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6351e94076329dab517ea94c115e15c4d8459381","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/77272b7fd0e472086fd626a1fcd11da625822cc2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8a3a54aa3e65ed76f8560a387243a7738ae0cb1c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2d4174f492458ecdcdef309243624999612d526","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7730acd6a01c5931a3afb83639810ff2fb9cc92","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f82f53e75eff382fc8f56b73279b54f7cf5a5c65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93207","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:15.357","lastModified":"2026-10-19T10:17:11.487","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry\n\nsvcauth_gss_decode_credbody() writes the caller's\nrpc_gss_wire_cred field by field and assigns gc_ctx.len only on\nthe success tail.  The caller storage is svcdata->clcred, which\nlives in the per-svc_rqst gss_svc_data and is reused across\nrequests.  Early decode failures leave partially decoded state\nmixed with residue from the prior request.\n\nThe trailing body_len tightness check is the sharpest case:\nxdr_stream_decode_opaque_inline() has already written gc_ctx.data\nwith a borrowed inline pointer into the current request's XDR\npages, but gc_ctx.len retains its prior value.  Once the request\npages are released the pooled clcred carries a dangling pointer\npaired with a stale length.\n\nZero the caller's rpc_gss_wire_cred at function entry so that\nevery early-return path leaves a deterministic all-zero cred.\nOn the trailing tightness-check path, gc_ctx.len is now zero\ninstead of stale, which neuters length-driven consumers such as\ngss_svc_searchbyctx() that would otherwise walk the dangling\ndata pointer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sunrpc/auth_gss/svcauth_gss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b0bc53470d1af01f62a0fe2d405cf56477804863","lessThan":"56b29d62017c7dd1718d060dd5b3a2ce61095d0c","versionType":"git","status":"affected"},{"version":"b0bc53470d1af01f62a0fe2d405cf56477804863","lessThan":"0e18641708eaa8bc3c1ff338cd844aeadbd52bac","versionType":"git","status":"affected"},{"version":"b0bc53470d1af01f62a0fe2d405cf56477804863","lessThan":"e0778464049b0238f2915a40007a4154f86cf351","versionType":"git","status":"affected"},{"version":"b0bc53470d1af01f62a0fe2d405cf56477804863","lessThan":"0fa8a8acae57e6373962741d5b06d13f44aba6a9","versionType":"git","status":"affected"},{"version":"b0bc53470d1af01f62a0fe2d405cf56477804863","lessThan":"11539e8fcce0b0af062ae5fecf7b3676c2f7aeed","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sunrpc/auth_gss/svcauth_gss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0e18641708eaa8bc3c1ff338cd844aeadbd52bac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0fa8a8acae57e6373962741d5b06d13f44aba6a9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/11539e8fcce0b0af062ae5fecf7b3676c2f7aeed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/56b29d62017c7dd1718d060dd5b3a2ce61095d0c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e0778464049b0238f2915a40007a4154f86cf351","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93208","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:15.497","lastModified":"2026-10-19T10:17:11.620","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkasan: fix cache shrink race with CPU hotplug\n\nkasan_quarantine_remove_cache() first invokes per_cpu_remove_cache() on\nall online CPUs.  Each callback moves objects belonging to the cache from\ncpu_quarantine to the CPU's shrink_qlist, where they can later be freed\nfrom task context.\n\nkmem_cache_destroy() invokes the quarantine removal path while holding\ncpus_read_lock(), but kmem_cache_shrink() does not.  The latter can\ntherefore race with CPU offlining as follows:\n\n  kmem_cache_shrink()             CPU hotplug\n  -------------------             -----------\n  on_each_cpu()\n    CPU1 moves objects to\n    CPU1's shrink_qlist\n  on_each_cpu() returns\n                                  CPU1 goes offline\n                                  kasan_cpu_offline()\n                                    drains cpu_quarantine\n                                    leaves shrink_qlist untouched\n  for_each_online_cpu()\n    skips CPU1\n\nThe objects left on CPU1's shrink_qlist are not returned to the slab\nallocator.  This may prevent kmem_cache_shrink() from releasing slabs that\nwould otherwise become empty.  If CPU1 remains offline, a later\nkmem_cache_destroy() also skips the list and can report that the cache\nstill contains objects.\n\nAn intermittent occurrence was observed with a virtio-9p filesystem.  The\nmount and umount commands both returned 0, but the kernel logged the\nfollowing during the userspace-triggered teardown:\n\n  [  2994.380134][  T111] BUG 9p-fcall-cache-1 (Tainted: G    B              ): Objects remaining on __kmem_cache_shutdown()\n  [  2994.381140][  T111] Object 0xff11000004361118 @offset=4376\n  [  2994.381607][  T111] Allocated in p9_fcall_init+0x201/0x400 age=19564 cpu=1 pid=104\n  [  2994.382591][  T111]  p9_fcall_init+0x201/0x400\n  [  2994.382810][  T111]  p9_tag_alloc+0x12f/0x700\n  [  2994.382982][  T111]  p9_client_prepare_req+0x102/0x3e0\n  [  2994.383165][  T111]  p9_client_rpc+0x1ab/0xa50\n  [  2994.383334][  T111]  p9_client_getattr_dotl+0xb0/0x1a0\n  [  2994.383515][  T111]  v9fs_vfs_getattr_dotl+0x115/0x360\n  [  2994.383719][  T111]  vfs_getattr_nosec+0x22c/0x3a0\n  [  2994.383910][  T111]  vfs_statx+0xd7/0x170\n  [  2994.384062][  T111]  vfs_fstatat+0x45/0x80\n  [  2994.384215][  T111]  __do_sys_newfstatat+0x84/0xe0\n  [  2994.384386][  T111]  do_syscall_64+0x115/0x6a0\n  [  2994.384566][  T111]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  [  2994.399720][  T111] WARNING: mm/slub.c:1244 at __kmem_cache_shutdown+0x363/0x500, CPU#0: busybox/111\n  [  2994.405655][  T111] Call Trace:\n  [  2994.406325][  T111]  kmem_cache_destroy+0x73/0x1b0\n  [  2994.406630][  T111]  p9_client_destroy+0x271/0x3c0\n  [  2994.407210][  T111]  v9fs_session_close+0x3c/0x260\n  [  2994.407409][  T111]  v9fs_kill_super+0x48/0x90\n  [  2994.407584][  T111]  deactivate_locked_super+0xa3/0x160\n  [  2994.407778][  T111]  cleanup_mnt+0x1dd/0x3e0\n\nThus, a successful umount left objects in the 9p fcall cache and prevented\nthe cache from being destroyed cleanly.\n\nPer-CPU shrink_qlist storage exists for every possible CPU, and each list\nis protected by its own raw spinlock.  Iterate over possible CPUs so that\na list populated before its CPU went offline is drained as well.\n\nfor_each_possible_cpu() can do more work than for_each_online_cpu(), but\nthis change only affects CONFIG_KASAN_GENERIC kernels.  The extra work is\nlimited to cache shrink and cache destruction paths and does not affect\nthe normal allocation/free fast path.  It adds one raw-spinlock-protected\nscan of each possible CPU's shrink list.  These lists are normally empty;\na non-empty list is traversed to remove objects belonging to the cache\nbeing shrunk or destroyed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/kasan/quarantine.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"07d067e4f2ceb72b9f681995cc53828caaba9e6e","lessThan":"7cd164f0e1bab0f8dd125c92ed4f19bbd6b92a4a","versionType":"git","status":"affected"},{"version":"07d067e4f2ceb72b9f681995cc53828caaba9e6e","lessThan":"709c3646545e0a1f99a5816384c633f6552c5a98","versionType":"git","status":"affected"},{"version":"07d067e4f2ceb72b9f681995cc53828caaba9e6e","lessThan":"30e8cb8598aa41b1b9f8803081d2ae5e5369c0f3","versionType":"git","status":"affected"},{"version":"07d067e4f2ceb72b9f681995cc53828caaba9e6e","lessThan":"3119d58e4ef8719d669911d38a53fc00086ac48b","versionType":"git","status":"affected"},{"version":"07d067e4f2ceb72b9f681995cc53828caaba9e6e","lessThan":"8790303cbaac52a11dfed4aab261f8ea60682525","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/kasan/quarantine.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/30e8cb8598aa41b1b9f8803081d2ae5e5369c0f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3119d58e4ef8719d669911d38a53fc00086ac48b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/709c3646545e0a1f99a5816384c633f6552c5a98","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cd164f0e1bab0f8dd125c92ed4f19bbd6b92a4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8790303cbaac52a11dfed4aab261f8ea60682525","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93209","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:15.710","lastModified":"2026-10-19T10:17:11.797","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb\n\nBT enable fails intermittently with -ETIMEDOUT (-110).  The kernel log\nshows the HCI Read Local Version command was sent and the firmware\nreplied with status 0x00 (logged by hci_req_cmd_complete() BT_DBG),\nbut the waiter in __hci_cmd_sync_sk() never woke up and timed out\nafter 10 s:\n\n  bluetooth hci0: Opcode 0xfc00              // __hci_cmd_sync_sk\n  bluetooth hci0: opcode 0xfc00 plen 1       // hci_cmd_sync_add\n  bluetooth hci0: skb len 4                  // hci_cmd_sync_alloc\n  bluetooth hci0: length 1                   // hci_req_sync_run\n  Bluetooth: hci0 cmd_cnt 1 cmd queued 1     // hci_cmd_work\n  Bluetooth: hci0 type 1 len 4               // hci_send_frame\n  Bluetooth: opcode 0xfc00 status 0x00       // hci_req_cmd_complete\n  <-- req_skb NULL: req_complete_skb not set,\n      hci_cmd_sync_complete() never called,\n      req_status stays HCI_REQ_PEND            -->\n  <-- 10 s later: wait_event_interruptible_timeout expires -->\n  bluetooth hci0: end: err -110              // __hci_cmd_sync_sk\n\nThe root cause is that hci_send_cmd_sync() clones the sent command\ninto hdev->req_skb so that hci_req_cmd_complete() can locate the\nregistered completion callback.  Under memory pressure this\nskb_clone() fails, leaving hdev->req_skb NULL.  The firmware reply\nis received and processed, but hci_req_cmd_complete() finds NULL\nreq_skb, so hci_cmd_sync_complete() is never called, req_status\nstays HCI_REQ_PEND, and the waiter times out with -ETIMEDOUT.\n\nreq_skb is only used to read bt_cb(skb)->hci callbacks and opcode --\nit is never modified.  Replace skb_clone() with skb_get(), which\nsimply increments the reference count of hdev->sent_cmd without\nallocating new memory and therefore cannot fail.\n\nThis issue was first observed as a use-after-free in ttyport_close()\nwhen ttyport_open() failed, which was investigated in an earlier\npatch series [1].  That investigation led to the discovery of the\ntrue root cause described above.\n\n[1] https://lore.kernel.org/all/20250430111617.1151390-1-quic_cxin@quicinc.com/"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/hci_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"da77c1d39bc527b31890bfa0405763c82828defb","lessThan":"0337fb092873a4146aa854acb554675b49c8f6b5","versionType":"git","status":"affected"},{"version":"2af7aa6685e22d0dc546b0d27e5f16d3afe211fa","lessThan":"d5eef0747071934a1c080ee617fa4fd3566394c5","versionType":"git","status":"affected"},{"version":"2615fd9a7c2507eb3be3fbe49dcec88a2f56454a","lessThan":"d7723320db4c9cb9ec2b9a36140e6c641dd77814","versionType":"git","status":"affected"},{"version":"2615fd9a7c2507eb3be3fbe49dcec88a2f56454a","lessThan":"d0b28e9655f4b3195210627577f81883dc1d0162","versionType":"git","status":"affected"},{"version":"2615fd9a7c2507eb3be3fbe49dcec88a2f56454a","lessThan":"26f66d5b8a5663af498f7ccc94fc79fb47a2191f","versionType":"git","status":"affected"},{"version":"2615fd9a7c2507eb3be3fbe49dcec88a2f56454a","lessThan":"f5afdff569a09d1cb8cf19826199d024725576cb","versionType":"git","status":"affected"},{"version":"4ff121be63b761950610f422437aaaef8e075c40","versionType":"git","status":"affected"},{"version":"18a4c59af609994552c8b39c5438304e070e55c7","versionType":"git","status":"affected"},{"version":"6.1.83","lessThan":"6.1.118","versionType":"semver","status":"affected"},{"version":"6.6.23","lessThan":"6.6.157","versionType":"semver","status":"affected"},{"version":"6.7.11","lessThan":"6.8","versionType":"semver","status":"affected"},{"version":"6.8.2","lessThan":"6.9","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/hci_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.1.118","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0337fb092873a4146aa854acb554675b49c8f6b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/26f66d5b8a5663af498f7ccc94fc79fb47a2191f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0b28e9655f4b3195210627577f81883dc1d0162","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5eef0747071934a1c080ee617fa4fd3566394c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7723320db4c9cb9ec2b9a36140e6c641dd77814","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5afdff569a09d1cb8cf19826199d024725576cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93210","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:15.877","lastModified":"2026-10-19T10:17:11.923","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: harden DFS cache against invalid target hints\n\nCurrently, get_tgt_name() returns ERR_PTR(-ENOENT) when ce->tgthint is\nNULL, and dfs_cache_noreq_update_tgthint() assumes ce->tgthint is always\nvalid.\n\nIn preparation for clearing ce->tgthint in free_tgts(), harden callers\nof get_tgt_name() against ERR_PTR results and harden\ndfs_cache_noreq_update_tgthint() against NULL pointer dereferences."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/dfs_cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"54be1f6c1c37498bba557049df646cc239fa37e3","lessThan":"a48328afbc3f63e3b9de8827e2e16c15b17976f7","versionType":"git","status":"affected"},{"version":"54be1f6c1c37498bba557049df646cc239fa37e3","lessThan":"6cb7f9fed8f40f28fbd464ca99c946951afc0952","versionType":"git","status":"affected"},{"version":"54be1f6c1c37498bba557049df646cc239fa37e3","lessThan":"66dbcdbb0cadffd12eb8f2b115fd57d384c5109d","versionType":"git","status":"affected"},{"version":"54be1f6c1c37498bba557049df646cc239fa37e3","lessThan":"846f0709559b9e27024e126a80bc7afb76516912","versionType":"git","status":"affected"},{"version":"54be1f6c1c37498bba557049df646cc239fa37e3","lessThan":"7e32da6047d9afdae8dd17b87b4c8d97363c4ee2","versionType":"git","status":"affected"},{"version":"54be1f6c1c37498bba557049df646cc239fa37e3","lessThan":"bf86c08123c6ab8c61cc0be1dad7540db93738ff","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/dfs_cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/66dbcdbb0cadffd12eb8f2b115fd57d384c5109d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6cb7f9fed8f40f28fbd464ca99c946951afc0952","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e32da6047d9afdae8dd17b87b4c8d97363c4ee2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/846f0709559b9e27024e126a80bc7afb76516912","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a48328afbc3f63e3b9de8827e2e16c15b17976f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf86c08123c6ab8c61cc0be1dad7540db93738ff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93211","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.007","lastModified":"2026-10-19T10:17:12.023","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: initialize DRC hash table before registering shrinker\n\nshrinker_register() precedes the INIT_LIST_HEAD loop and the\ndrc_hashsize store. On weakly-ordered architectures (arm64, ppc),\na shrinker scan can observe drc_hashsize before the bucket list\nheads are initialized, causing a NULL deref in the DRC shrinker\ncallback.\n\nMove bucket initialization and the drc_hashsize store before\nshrinker_register() so the hash table is fully initialized before\nit becomes visible to the shrinker."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/nfsd/nfscache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8eea99a81c6f67c08fedd7db2ccd09aa93db69a7","lessThan":"f060f43a67635dbb393bf5dcbfc3e8b9a44942cb","versionType":"git","status":"affected"},{"version":"8eea99a81c6f67c08fedd7db2ccd09aa93db69a7","lessThan":"b57bd8cb739cb3cf88bdb1a5903a42a707a5c282","versionType":"git","status":"affected"},{"version":"8eea99a81c6f67c08fedd7db2ccd09aa93db69a7","lessThan":"431c70ca5163c98c746f22f16cd58ca5aefec6dc","versionType":"git","status":"affected"},{"version":"8eea99a81c6f67c08fedd7db2ccd09aa93db69a7","lessThan":"b0c58934f5cc4f05b63ef6605dd10c1d0d489e88","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/nfsd/nfscache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/431c70ca5163c98c746f22f16cd58ca5aefec6dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0c58934f5cc4f05b63ef6605dd10c1d0d489e88","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b57bd8cb739cb3cf88bdb1a5903a42a707a5c282","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f060f43a67635dbb393bf5dcbfc3e8b9a44942cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93212","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.133","lastModified":"2026-10-19T10:17:12.113","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: guard nfsd_serv deref in nfsd_file_net_dispose\n\nnfsd_file_net_dispose() is the consumer side of l->freeme: the nfsd\nservice thread loop calls it to drain entries that the filecache\ngarbage collector and shrinker append via\nnfsd_file_dispose_list_delayed().  During per-net teardown,\nnn->nfsd_serv is cleared before the filecache laundrette is shut\ndown, so the service thread can still run a dispose pass that finds\nmore than eight entries on l->freeme and dereferences a NULL\nsvc_serv:\n\n    nfsd service thread loop\n      nfsd_file_net_dispose(nn)\n        if (!list_empty(&l->freeme)) {\n            ...\n            svc_wake_up(nn->nfsd_serv);   /* nn->nfsd_serv == NULL */\n        }\n\nThe sibling helper nfsd_file_dispose_list_delayed() already documents\nthis ordering and caches nn->nfsd_serv into a local before testing it\nfor NULL.  nfsd_file_net_dispose() was introduced with the same raw\nsvc_wake_up(nn->nfsd_serv) call and never picked up the guard.\n\nFix by loading nn->nfsd_serv into a local svc_serv pointer and only\ncalling svc_wake_up() when it is non-NULL, matching the pattern in\nnfsd_file_dispose_list_delayed()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/nfsd/filecache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ffb402596147ac583f3464ff5c48feb9423e3838","lessThan":"f4776c1c4b38fbc459420321c8ece87d0f7f95fb","versionType":"git","status":"affected"},{"version":"ffb402596147ac583f3464ff5c48feb9423e3838","lessThan":"59baf45a06435194005fc5fa9a42d89f77a30432","versionType":"git","status":"affected"},{"version":"ffb402596147ac583f3464ff5c48feb9423e3838","lessThan":"766170b4fd2daaf5c4d6735560101474e18edab6","versionType":"git","status":"affected"},{"version":"ffb402596147ac583f3464ff5c48feb9423e3838","lessThan":"9f1ddfc8cb9076592401a611eb3a44d36186d014","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/nfsd/filecache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/59baf45a06435194005fc5fa9a42d89f77a30432","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/766170b4fd2daaf5c4d6735560101474e18edab6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f1ddfc8cb9076592401a611eb3a44d36186d014","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f4776c1c4b38fbc459420321c8ece87d0f7f95fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93213","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.257","lastModified":"2026-10-19T10:17:12.210","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nof: fix out-of-bounds read in of_alias_scan() stem parser\n\nThe stem parser tests isdigit(*(end - 1)) before checking end > start\nand so reads one byte before the property name when the name is empty\nor all digits. Check the bound first."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/of/base.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"fd0c7bbda81c0e0c1cb7b68d267b87371584f560","versionType":"git","status":"affected"},{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"958d7ee9fcf008ef9d2072c6410ee1bf6abf3b64","versionType":"git","status":"affected"},{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"f7f6c3e32a31f2e1ed12075e8cd22b370a84e67a","versionType":"git","status":"affected"},{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"da7a80ddc610a19b0378016a4d816b9355f013a7","versionType":"git","status":"affected"},{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"96a9c984dd7c3589a2707a32b62802f98311dbfd","versionType":"git","status":"affected"},{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"9253cfc5a85be1494ce56b4fc6f2d2b509440910","versionType":"git","status":"affected"},{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"acd1b49043366f43e932308b4db7d3ce568eeadb","versionType":"git","status":"affected"},{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/of/base.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9253cfc5a85be1494ce56b4fc6f2d2b509440910","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/958d7ee9fcf008ef9d2072c6410ee1bf6abf3b64","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96a9c984dd7c3589a2707a32b62802f98311dbfd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/acd1b49043366f43e932308b4db7d3ce568eeadb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da7a80ddc610a19b0378016a4d816b9355f013a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f7f6c3e32a31f2e1ed12075e8cd22b370a84e67a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd0c7bbda81c0e0c1cb7b68d267b87371584f560","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93214","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.397","lastModified":"2026-10-19T10:17:12.323","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_tcm: fix deadlock in usbg_make_tpg()\n\nusbg_make_tpg() held dep_lock while calling\nconfigfs_depend_item_unlocked(), which acquires the configfs root\ninode lock when operating across subsystems. This creates a circular\nlock dependency with configfs_rmdir():\n\n  dep_lock -> configfs root inode lock -> su_mutex -> dep_lock\n\nIn usbg_make_tpg(), dep_lock only serialized the read of opts->ready,\nwhich is a monotonic flag that transitions from false to true exactly\nonce (in tcm_set_name()) and never reverts. Remove dep_lock from\nusbg_make_tpg() entirely and use READ_ONCE/WRITE_ONCE to access\nopts->ready locklessly instead."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/gadget/function/f_tcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"abad5daa41cf5d0a0a9cba0397d3a0e7f11e0277","versionType":"git","status":"affected"},{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"3639438a4c83ffc2e564c8c010b92137c5d11cfa","versionType":"git","status":"affected"},{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"78a14ea2284825055ab6c2a1f3489510f560f3a2","versionType":"git","status":"affected"},{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"eef3e62f90d86c1c5651742f84ecc9db1814a893","versionType":"git","status":"affected"},{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"f81a2da137b029a282b9bc64d2f267d242948659","versionType":"git","status":"affected"},{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"6bcd9ee6ad6989d1d85a7459687e45b7ad7568d9","versionType":"git","status":"affected"},{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"d90b0f90e30cd59b36005a4016b15cf02bcd7fb2","versionType":"git","status":"affected"},{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"9dbf74f4022f80f7669d2b3c22c5deb46c1b5674","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/gadget/function/f_tcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.5","status":"affected"},{"version":"0","lessThan":"4.5","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3639438a4c83ffc2e564c8c010b92137c5d11cfa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6bcd9ee6ad6989d1d85a7459687e45b7ad7568d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78a14ea2284825055ab6c2a1f3489510f560f3a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9dbf74f4022f80f7669d2b3c22c5deb46c1b5674","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/abad5daa41cf5d0a0a9cba0397d3a0e7f11e0277","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d90b0f90e30cd59b36005a4016b15cf02bcd7fb2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eef3e62f90d86c1c5651742f84ecc9db1814a893","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f81a2da137b029a282b9bc64d2f267d242948659","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93215","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.550","lastModified":"2026-10-19T10:17:12.440","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncdx: Fix double free when sysfs file creation fails\n\nIn cdx_create_res_attr(), if sysfs_create_bin_file() fails, the code\nfrees res_attr but doesn't set cdx_dev->res_attr[num] to NULL. This\nleaves a dangling pointer in the array. Then cdx_destroy_res_attr()\nfrees the already-freed memory. Fix the double free by initializing\ncdx_dev->res_attr[num] after sysfs_create_bin_file() completes."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/cdx/cdx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"aeda33ab8160c7a2e24ba4f44492ad1e974ddc7d","lessThan":"88f4cd42a04bdadd189d7f667a4c279f4e962ca6","versionType":"git","status":"affected"},{"version":"aeda33ab8160c7a2e24ba4f44492ad1e974ddc7d","lessThan":"4cd24873ab9fdbd730604881a6e8087bc7b99336","versionType":"git","status":"affected"},{"version":"aeda33ab8160c7a2e24ba4f44492ad1e974ddc7d","lessThan":"7e9451bf0bdba6daee1eaf4e7566612af6ca1c32","versionType":"git","status":"affected"},{"version":"aeda33ab8160c7a2e24ba4f44492ad1e974ddc7d","lessThan":"6f4acc3a3c300e174e3f586b97b04ed8f5948c36","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/cdx/cdx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4cd24873ab9fdbd730604881a6e8087bc7b99336","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f4acc3a3c300e174e3f586b97b04ed8f5948c36","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e9451bf0bdba6daee1eaf4e7566612af6ca1c32","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/88f4cd42a04bdadd189d7f667a4c279f4e962ca6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93216","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.670","lastModified":"2026-10-21T13:21:04.503","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()\n\nprint_page_owner_memcg() reads page->memcg_data via READ_ONCE() at the\nstart to guard against tail pages and NULL data.  However, it later\nre-reads page->memcg_data locklessly in two places:\n\n1: page_memcg_check(page)\n\n2: PageMemcgKmem(page) (via folio_memcg_kmem(), which includes\n   VM_BUG_ON assertions for tail pages and MEMCG_DATA_OBJEXTS)\n\nIf the page is concurrently freed and reallocated as a THP tail page or\nslab page between these calls, the VM_BUG_ON assertions can trigger on\nCONFIG_DEBUG_VM=y builds, crashing the kernel.\n\nFix both TOCTOU issues by using the memcg_data snapshot throughout."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/page_owner.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fcf8935832b86d3437f00e732c6d0d4d2819d6a9","lessThan":"e7c1923c5f30a6953f0540e3171d882ec17b05d3","versionType":"git","status":"affected"},{"version":"fcf8935832b86d3437f00e732c6d0d4d2819d6a9","lessThan":"a4c940ab3f794f221a338c9431ad1ce0d73a2bea","versionType":"git","status":"affected"},{"version":"fcf8935832b86d3437f00e732c6d0d4d2819d6a9","lessThan":"46761406e14381dc35f498c247a87565b87ea2ef","versionType":"git","status":"affected"},{"version":"fcf8935832b86d3437f00e732c6d0d4d2819d6a9","lessThan":"90f095b816e25c6a9e4446d299bac5007fdcb3df","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/page_owner.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/46761406e14381dc35f498c247a87565b87ea2ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/90f095b816e25c6a9e4446d299bac5007fdcb3df","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4c940ab3f794f221a338c9431ad1ce0d73a2bea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7c1923c5f30a6953f0540e3171d882ec17b05d3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93217","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.790","lastModified":"2026-10-19T10:17:12.627","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/madvise: skip device-private PMDs in cold and pageout walks\n\nmadvise_cold_or_pageout_pte_range() takes pmd_trans_huge_lock(), whose\npmd_is_huge() check returns true for a device-private PMD.  The subsequent\n!pmd_present() branch has a VM_BUG_ON() asserting migration is the only\nallowed non-present case; a device-private PMD trips it.\n\nSkip device-private PMDs in that non-present branch and continue to\nhuge_unlock before calling pmd_folio().  Downgrade the check to\nVM_WARN_ON_ONCE() so an unexpected PMD softleaf logs a warning rather than\npanicking.  Drop the thp_migration_supported() guard: it expands to\nIS_ENABLED(CONFIG_ARCH_SUPPORTS_PMD_SOFTLEAF), and both\npmd_is_migration_entry() and pmd_is_device_private_entry() already return\nfalse when that config is not selected, so the guard suppresses only the\ncase where the warning would already be silent.\n\nPotential trigger: an HMM-based GPU driver races with\nmadvise(MADV_COLD)/MADV_PAGEOUT: pmd_trans_huge(*pmd) reads true, then\nmigrate_vma_pages() flips the PMD to a device-private entry before the PMD\nlock is acquired."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/madvise.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"368076f52ebeecd33e10a9f80905d7508b6b6149","lessThan":"5c0d7b658cda62cd17cb3652783386d5608030ef","versionType":"git","status":"affected"},{"version":"368076f52ebeecd33e10a9f80905d7508b6b6149","lessThan":"d4b76d0b03cb49611312ecc4bcfb55ccdf0843e2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/madvise.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5c0d7b658cda62cd17cb3652783386d5608030ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d4b76d0b03cb49611312ecc4bcfb55ccdf0843e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93218","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.907","lastModified":"2026-10-19T10:17:12.730","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd\n\nmadvise_free_pte_range() checks pmd_trans_huge(*pmd) unlocked, then\nmadvise_free_huge_pmd() takes pmd_trans_huge_lock().  pmd_is_huge()\nreturns true for a device-private PMD, so orig_pmd can be device-private\nand enter the !pmd_present() branch.\n\nSkip device-private PMDs in that non-present branch and continue to out\nbefore calling pmd_folio().  Downgrade the check to VM_WARN_ON_ONCE() so\nan unexpected PMD softleaf logs a warning rather than panicking.  Drop the\nthp_migration_supported() guard: it expands to\nIS_ENABLED(CONFIG_ARCH_SUPPORTS_PMD_SOFTLEAF), and both\npmd_is_migration_entry() and pmd_is_device_private_entry() already return\nfalse when that config is not selected, so the guard suppresses only the\ncase where the warning would already be silent.\n\nPotential trigger: an HMM-based GPU driver races with madvise(MADV_FREE):\nmigrate_vma_pages() flips the PMD to a device-private entry between the\ncaller's pmd_trans_huge() check and the callee's pmd_trans_huge_lock()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/huge_memory.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"368076f52ebeecd33e10a9f80905d7508b6b6149","lessThan":"5e3026bf736498115884d6c7bd0308ba29e0474c","versionType":"git","status":"affected"},{"version":"368076f52ebeecd33e10a9f80905d7508b6b6149","lessThan":"ce579dcf730ce5ed8043a5eeea18a3e6706a97e5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/huge_memory.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5e3026bf736498115884d6c7bd0308ba29e0474c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce579dcf730ce5ed8043a5eeea18a3e6706a97e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93219","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.030","lastModified":"2026-10-19T10:17:12.820","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource/drivers/timer-sun4i: Advertise a real minimum delta\n\nsun4i_clkevt_next_event() compensates for the timer stop/start\nsynchronization delay by programming evt - TIMER_SYNC_TICKS into the\nhardware interval register. The clockevent device currently advertises\nTIMER_SYNC_TICKS as min_delta_ticks, so the clockevents core is allowed\nto call set_next_event() with evt == TIMER_SYNC_TICKS.\n\nThat programs a zero-tick interval. With oneshot/highres/nohz timer\noperation this can leave the next event stuck, which was observed as a\nboot hang on Allwinner D1 after the clockevents core started reusing\nforced minimum-delta events.\n\nAdvertise one extra tick instead, so the smallest event accepted by the\ncore still programs at least one hardware tick after the synchronization\ncompensation."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/clocksource/timer-sun4i.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"0cc4b14d7401d50e53a01f1554147ee075ee6943","versionType":"git","status":"affected"},{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"53a3bc024b8e5d284468cce84957cded5f859f98","versionType":"git","status":"affected"},{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"753a220084dfc4d737f2ab9eaddc9a01a397edd7","versionType":"git","status":"affected"},{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"ebba4d0aeba0e8eb3a9676380fc2652de8ab1c44","versionType":"git","status":"affected"},{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"151eb52f8712017c8f7b00bb2305e8916cb9e3dc","versionType":"git","status":"affected"},{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"bf38be01d43c4e4ca903aff7236d8486a950a252","versionType":"git","status":"affected"},{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"f0efafcdf6eec1f3361bfd8c811420198f55c8bb","versionType":"git","status":"affected"},{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"d21808328225ab8cee46885bf9a0dffcefbe630e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/clocksource/timer-sun4i.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.13","status":"affected"},{"version":"0","lessThan":"3.13","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0cc4b14d7401d50e53a01f1554147ee075ee6943","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/151eb52f8712017c8f7b00bb2305e8916cb9e3dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/53a3bc024b8e5d284468cce84957cded5f859f98","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/753a220084dfc4d737f2ab9eaddc9a01a397edd7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf38be01d43c4e4ca903aff7236d8486a950a252","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d21808328225ab8cee46885bf9a0dffcefbe630e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ebba4d0aeba0e8eb3a9676380fc2652de8ab1c44","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0efafcdf6eec1f3361bfd8c811420198f55c8bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93220","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.197","lastModified":"2026-10-19T10:17:12.933","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Keep kick_sync waiting on the rq's own CPU\n\nkick_sync_wait_bal_cb() assumes it runs on the rq's CPU from the\n__schedule() tail: the snapshots it compares against live in that CPU's\npercpu area and the busy-wait runs with the rq lock dropped and IRQs\nenabled.\n\nHowever, dispatch can now drop the rq lock while the callback sits queued,\nand rq lock takers in that window (the sched class change paths, the scx\ntask iterator) flush pending balance callbacks on release, running the\ncallback on a foreign CPU. Such a run compares against unrelated snapshots\nand can deadlock when the executing CPU is itself a wait target.\n\nBail on a foreign CPU and leave the wait state alone. The wait only observes\nprogress that the resched kicks already guarantee and the rq's next wait\npicks up the stale cpus_to_sync bits."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/sched/ext/ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4c95380701f58b8112f0b891de8d160e4199e19d","lessThan":"c736ea0fe7b4df920da6bd43a81c5eeecadcc8be","versionType":"git","status":"affected"},{"version":"4c95380701f58b8112f0b891de8d160e4199e19d","lessThan":"e0253dd04beb03e79477c5ef4768b11135687206","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/sched/ext/ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/c736ea0fe7b4df920da6bd43a81c5eeecadcc8be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e0253dd04beb03e79477c5ef4768b11135687206","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93221","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.310","lastModified":"2026-10-21T13:21:04.787","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: convert nfsd_net boolean flags to unsigned long flags word\n\nnfsd_net contains several boolean fields that are accessed from\nconcurrent contexts without serialization.  In particular,\nnfsd4_end_grace() guards its drain path with a plain bool:\n\n    if (nn->grace_ended)\n            return;\n    nn->grace_ended = true;\n\nThe read and the write are independent, and nothing in struct\nnfsd_net serializes them.  At least two contexts can reach this\ncode with no lock held:\n\n    laundromat path\n      laundry_wq kworker\n        nfs4_laundromat()\n          nfsd4_end_grace()\n\n    RECLAIM_COMPLETE path\n      nfsd compound kthread\n        nfsd4_reclaim_complete()\n          inc_reclaim_complete()\n            nfsd4_end_grace()\n\nBoth callers can observe grace_ended == false on different CPUs,\nboth store true, and both proceed into nfsd4_record_grace_done(),\nwhich invokes the active client_tracking_ops->grace_done callback.\nFor tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops\nvia nfsd4_recdir_purge_old, and the cld v1+ ops via\nnfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(),\nwhich walks every bucket of reclaim_str_hashtbl with no lock and\ncalls nfs4_remove_reclaim_record() (list_del + kfree) on each\nentry.  Two concurrent walkers corrupt the list and double-free\nevery nfs4_client_reclaim.  A concurrent nfsd4_find_reclaim_client()\niterating the same bucket reads through freed memory.\n\nA third call site exists in nfs4_state_start_net() on the\nskip_grace startup path, but it runs under nfsd_mutex before any\nclient has connected and before the laundromat's first delayed\nwork fires, so it cannot race with the two callers above.\n\nReplace the scattered boolean fields in nfsd_net with a single\nunsigned long flags word and an enum nfsd_net_flag for the bit\npositions.  The grace_ended race is fixed by using\ntest_and_set_bit(), which is atomic on all architectures.  The\nremaining flags (grace_end_forced, in_grace, somebody_reclaimed,\ntrack_reclaim_completes, nfsd_net_up, lockd_up) are converted to\nuse test_bit/set_bit/clear_bit for consistency.  This avoids\nsub-word cmpxchg issues on architectures like Hexagon that only\nsupport word-sized atomic operations."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/nfsd/netns.h","fs/nfsd/nfs4proc.c","fs/nfsd/nfs4recover.c","fs/nfsd/nfs4state.c","fs/nfsd/nfsctl.c","fs/nfsd/nfssvc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"362063a595be959bc08f4163e6405a0266740091","lessThan":"94b450977c60261903c945419d2df4a464de60c4","versionType":"git","status":"affected"},{"version":"362063a595be959bc08f4163e6405a0266740091","lessThan":"faac245ca739b66e96fb7bb43e21df537239a4e5","versionType":"git","status":"affected"},{"version":"362063a595be959bc08f4163e6405a0266740091","lessThan":"40bab0da844c142431a6b1cc21b4cf53491dac44","versionType":"git","status":"affected"},{"version":"362063a595be959bc08f4163e6405a0266740091","lessThan":"df5922fe09a8131c793ffa86adf204999b0470f8","versionType":"git","status":"affected"},{"version":"362063a595be959bc08f4163e6405a0266740091","lessThan":"11a5fe42e1811f793e04ef885b639ea7668f439d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/nfsd/netns.h","fs/nfsd/nfs4proc.c","fs/nfsd/nfs4recover.c","fs/nfsd/nfs4state.c","fs/nfsd/nfsctl.c","fs/nfsd/nfssvc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.2","status":"affected"},{"version":"0","lessThan":"5.2","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/11a5fe42e1811f793e04ef885b639ea7668f439d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/40bab0da844c142431a6b1cc21b4cf53491dac44","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94b450977c60261903c945419d2df4a464de60c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df5922fe09a8131c793ffa86adf204999b0470f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/faac245ca739b66e96fb7bb43e21df537239a4e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93222","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.437","lastModified":"2026-10-19T10:17:13.150","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsignal: avoid shared siginfo namespace rewrites\n\nsend_signal_locked() rewrites sender ids for the target namespace.  Group\nsends reuse the same siginfo, so one recipient can affect the next.\n\nCopy the siginfo before changing it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/signal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"e015d1ac6b43a23c52c5163299414ae77d7d4ae0","versionType":"git","status":"affected"},{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"4ee7c4e4719a825052f42f02ec159b5b42b68fbc","versionType":"git","status":"affected"},{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"148b0dae2a1755beb873a2aab51fb191414f068c","versionType":"git","status":"affected"},{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"6b1de022304ef85284c5933a5fb8492f6f54efc9","versionType":"git","status":"affected"},{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"03c8761e75d1619906bb503686f9cc1dfc6a67f4","versionType":"git","status":"affected"},{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"a246da20c8e4ae4319511c698b9f26ad0ad1769f","versionType":"git","status":"affected"},{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"b655c2040ce836afad5643842543567b31f8c11d","versionType":"git","status":"affected"},{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"d19cdc167e696714509e87d3f7ae765b6e164589","versionType":"git","status":"affected"},{"version":"e897dd22800f02bd48aefb1511fff0b2ce96e94c","versionType":"git","status":"affected"},{"version":"2f0e9eed11ca778d0ec5507a739c28472fd4ca20","versionType":"git","status":"affected"},{"version":"5.1.20","lessThan":"5.2","versionType":"semver","status":"affected"},{"version":"5.2.3","lessThan":"5.3","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/signal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/03c8761e75d1619906bb503686f9cc1dfc6a67f4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/148b0dae2a1755beb873a2aab51fb191414f068c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4ee7c4e4719a825052f42f02ec159b5b42b68fbc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b1de022304ef85284c5933a5fb8492f6f54efc9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a246da20c8e4ae4319511c698b9f26ad0ad1769f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b655c2040ce836afad5643842543567b31f8c11d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d19cdc167e696714509e87d3f7ae765b6e164589","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e015d1ac6b43a23c52c5163299414ae77d7d4ae0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93223","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.590","lastModified":"2026-10-19T10:17:13.260","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: media: tegra-video: fix of_node_put() on VIP parse errors\n\ntegra_vip_channel_of_parse() initializes np from dev->of_node without\ntaking a reference, but its error paths drop one through the\nerr_node_put label. This underflows the refcount of the VIP device's\nOF node when endpoint parsing fails on a malformed device tree.\n\nThe only reference the function takes on np is the success-path\nof_node_get() stored in vip->chan.of_node, and that one is already\nreleased by the tegra_vip_init() error path and by tegra_vip_exit().\n\nReturn errors directly instead of jumping to the bogus cleanup label."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/media/tegra-video/vip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e740d199cf0ff1e53ddc2ab067c0a09b55845d68","lessThan":"a3783800c9475fa58b8db0885893f96a23f949da","versionType":"git","status":"affected"},{"version":"e740d199cf0ff1e53ddc2ab067c0a09b55845d68","lessThan":"1295ba29ac590bbb5c4a586afd408018168af10b","versionType":"git","status":"affected"},{"version":"e740d199cf0ff1e53ddc2ab067c0a09b55845d68","lessThan":"656d047dc0c29c0964d840217a0593f16aa9bc5e","versionType":"git","status":"affected"},{"version":"e740d199cf0ff1e53ddc2ab067c0a09b55845d68","lessThan":"fc9937019cf7e2fe4e29f9341e6400bcd2cde721","versionType":"git","status":"affected"},{"version":"e740d199cf0ff1e53ddc2ab067c0a09b55845d68","lessThan":"7393372f79db940acff206b43e2905685a0c57ad","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/media/tegra-video/vip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1295ba29ac590bbb5c4a586afd408018168af10b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/656d047dc0c29c0964d840217a0593f16aa9bc5e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7393372f79db940acff206b43e2905685a0c57ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3783800c9475fa58b8db0885893f96a23f949da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc9937019cf7e2fe4e29f9341e6400bcd2cde721","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93224","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.720","lastModified":"2026-10-19T10:17:13.357","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Fix unmatched rn_unregister on failed accept\n\nWhen svc_rdma_accept() takes the errout path before\nrpcrdma_rn_register() has succeeded, the existing cleanup block\ncalls rpcrdma_rn_unregister(dev, &newxprt->sc_rn) unconditionally.\nsvcxprt_rdma is kzalloc'd, so on that path sc_rn.rn_index is 0 and\nsc_rn.rn_done is NULL; the unregister therefore xa_erase()s another\ncaller's slot 0 and performs an unmatched kref_put() on the\nrpcrdma_device's rd_kref.\n\nThe same errout also brackets the cleanup with svc_xprt_get()/\nsvc_xprt_put() around the kref_init() birth reference. The kref\ngoes 1 -> 2 -> 1 and never reaches 0, so the svcxprt_rdma (and the\nnet/ns_tracker it pinned) is leaked on every failed accept.\n\nrpcrdma_rn_register() writes rn->rn_done last, only after xa_alloc()\nand kref_get() have both succeeded, so rn_done == NULL is a natural\n\"never registered\" sentinel. Guard rpcrdma_rn_unregister() with an\nearly return when rn_done is NULL, and clear rn_done before the\nmatching xa_erase() so a repeated unregister is also a no-op.\n\nWith that guard in place, the accept errout drops the kref_init()\nbirth reference via svc_xprt_put(), which dispatches svc_rdma_free().\nTeardown of sc_qp, sc_sq_cq, sc_rq_cq, and sc_pd runs under existing\nIS_ERR/NULL guards in svc_rdma_free(); sc_rn is covered by the new\nrn_done sentinel; sc_cm_id is non-NULL on every errout path because\nsvc_rdma_accept() dereferences it above the first goto errout.\n\nsvc_xprt_free() drops the module reference associated with the freed\ntransport, and svc_handle_xprt() drops its pre-acquired reference\nwhen ->xpo_accept() returns NULL. Take a replacement module reference\nbefore svc_xprt_put() so the two module_put()s remain balanced.\n\nThe rn_done guard also covers svc_rdma_free()'s non-listener call\nto rpcrdma_rn_unregister() for transports whose register attempt\nfailed or never ran."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sunrpc/xprtrdma/ib_client.c","net/sunrpc/xprtrdma/svc_rdma_transport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cb3cba0ec372fa7c5f5f5c12990bef02e458ab86","lessThan":"0335800071a6dfdf7d21d729b5e7d8fa98936211","versionType":"git","status":"affected"},{"version":"8ac6fcae5dc0e801f1c82a83f5ae2c0a4db19932","lessThan":"5aabe070c00e5bdf4ab150fb5f72ad5f266d6241","versionType":"git","status":"affected"},{"version":"8ac6fcae5dc0e801f1c82a83f5ae2c0a4db19932","lessThan":"45a444a17240f4fa2235f0dfd4a96fc80f1eb2c2","versionType":"git","status":"affected"},{"version":"8ac6fcae5dc0e801f1c82a83f5ae2c0a4db19932","lessThan":"26190394c64c9429481fc88a4738f70bb92fb352","versionType":"git","status":"affected"},{"version":"d310955106c358c8e1ea682defd8e21af44a6cba","versionType":"git","status":"affected"},{"version":"6.12.35","lessThan":"6.12.109","versionType":"semver","status":"affected"},{"version":"6.15.4","lessThan":"6.16","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sunrpc/xprtrdma/ib_client.c","net/sunrpc/xprtrdma/svc_rdma_transport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0335800071a6dfdf7d21d729b5e7d8fa98936211","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/26190394c64c9429481fc88a4738f70bb92fb352","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/45a444a17240f4fa2235f0dfd4a96fc80f1eb2c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5aabe070c00e5bdf4ab150fb5f72ad5f266d6241","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93225","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.857","lastModified":"2026-10-19T10:17:13.503","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nphy: fsl-imx8mq-usb: fix typec switch leak on probe error path\n\nIf probe fails after imx95_usb_phy_get_tca() succeeds, the typec\nswitch leaks because the only cleanup path was in .remove(), which\nnever runs on probe failure.\n\nUse devm_add_action_or_reset() so the switch is cleaned up on both\nprobe failure and driver removal. The imx95_usb_phy_put_tca() is no\nlonger needed, it will be removed in .remove() too."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/phy/freescale/phy-fsl-imx8mq-usb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b58f0f86fd6156d7b084257f5c91ceaf7d760927","lessThan":"f1b7b2c7ffa9711d1298f52790b377fe02efc1db","versionType":"git","status":"affected"},{"version":"b58f0f86fd6156d7b084257f5c91ceaf7d760927","lessThan":"84646f5b945a370f6999eed59a334387b0abc282","versionType":"git","status":"affected"},{"version":"b58f0f86fd6156d7b084257f5c91ceaf7d760927","lessThan":"87a1805b1c346b092c34f96f3806f207792910e1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/phy/freescale/phy-fsl-imx8mq-usb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.4,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/84646f5b945a370f6999eed59a334387b0abc282","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87a1805b1c346b092c34f96f3806f207792910e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1b7b2c7ffa9711d1298f52790b377fe02efc1db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93226","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.973","lastModified":"2026-10-19T10:17:13.610","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: use RCU iterator to dump route exceptions\n\nrt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over\nRCU-protected exception lists. The caller holds rcu_read_lock(), but does\nnot hold rt6_exception_lock, so rt6_insert_exception() can concurrently\nadd an entry with hlist_add_head_rcu().\n\nKCSAN reports this race (irrelevant details omitted):\n\n  ==================================================================\n  BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions\n\n  write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5:\n    rt6_insert_exception+0x3bb/0x760\n    __ip6_rt_update_pmtu+0x4fe/0x750\n    ip6_sk_update_pmtu+0x19a/0x3b0\n    udpv6_err+0x3ff/0x800\n    icmpv6_notify+0x1e1/0x440\n    icmpv6_rcv+0x8c0/0xab0\n    ip6_protocol_deliver_rcu+0x616/0x840\n    ip6_input_finish+0xb9/0x160\n    ...\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n  read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14:\n    rt6_nh_dump_exceptions+0xb3/0x260\n    rt6_dump_route+0x53e/0x5f0\n    fib6_dump_node+0x6d/0xf0\n    fib6_walk_continue+0x290/0x2d0\n    fib6_dump_table+0x28d/0x360\n    inet6_dump_fib+0x37d/0x620\n    rtnl_dumpit+0x7b/0xd0\n    netlink_dump+0x3ae/0x7e0\n    ...\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n  4 locks held by dumper/549:\n    ...\n    #1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620\n    #2: (&tb->tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360\n    #3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0\n\n  value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100\n\n  Reported by Kernel Concurrency Sanitizer on:\n  CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted\n  7.2.0-rc7-virtme #38 PREEMPT(lazy)\n  ...\n\nUse hlist_for_each_entry_rcu() to safely iterate over the exception list."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"dffbfb3117138e8e0e09d05f507bd36ca1f696e5","versionType":"git","status":"affected"},{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"6bd3f94ed858f2d072627546b4cdf712b0f8ea88","versionType":"git","status":"affected"},{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"9c6be625e1a7258e845d6193b3b6b084a00f8e9e","versionType":"git","status":"affected"},{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"3665abc3d2ae8a78cb67f858e848481432ec75db","versionType":"git","status":"affected"},{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"eda56ee17713f9dd834b922f7dbfa2e25fa6358c","versionType":"git","status":"affected"},{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"a602cd128d17a793e12888edc8eda85821ede7e1","versionType":"git","status":"affected"},{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"f6b1b15848fd91fe122dac0d19d3d666e35075b6","versionType":"git","status":"affected"},{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"47cdab0d51aaa9bd85f8e4904585bd5bd4df4488","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3665abc3d2ae8a78cb67f858e848481432ec75db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/47cdab0d51aaa9bd85f8e4904585bd5bd4df4488","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6bd3f94ed858f2d072627546b4cdf712b0f8ea88","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c6be625e1a7258e845d6193b3b6b084a00f8e9e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a602cd128d17a793e12888edc8eda85821ede7e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dffbfb3117138e8e0e09d05f507bd36ca1f696e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eda56ee17713f9dd834b922f7dbfa2e25fa6358c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f6b1b15848fd91fe122dac0d19d3d666e35075b6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93227","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:18.130","lastModified":"2026-10-19T10:17:13.737","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn\n\nWith CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled, deferred_grow_zone()\ninitializes struct pages early in boot to satisfy an allocation.\n\nWith a large CMA reservation in place, the ranges deferred_init_memmap()\nfinds may not add up to the allocation it was asked for, and the function\nends up initializing the memory map of the entire zone and still falls\nshort.\n\nThat is fine in itself: the function accounts for it and leaves the\ncaller to decide whether it now has enough memory.\n\nHowever, the update of pgdat->first_deferred_pfn that tracks where\nuninitialized memory map starts could overflow.\n\nIf the node's RAM end is not aligned on PAGES_PER_SECTION boundaries and\nsome deferred struct pages were initialized, pgdat->first_deferred_pfn\nwould point past the end of the node's memory.\n\ndeferred_init_memmap() later picks up from pgdat->first_deferred_pfn and\nhits a BUG_ON(), because it expects a pfn within its node.\n\nFor example, when running a kernel with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y\nand CONFIG_CMA=y using the following qemu command line\n\n  qemu-system-x86_64 -enable-kvm -m 8032M -kernel bzImage \\\n      -append \"nokaslr cma=4768M@0x100000000\"\n\nthe kernel panics:\n\n  kernel BUG at mm/mm_init.c:2131!\n  CPU: 3 UID: 0 PID: 36 Comm: pgdatinit0 Not tainted 7.2.0-rc6 #1\n  RIP: 0010:deferred_init_memmap+0x1b8/0x1c0\n  RAX: 0000000000236000 R13: 0000000000238000\n  Call Trace:\n   kthread+0xdf/0x120\n   ret_from_fork+0x187/0x250\n\nMake sure that the update of pgdta->first_deferred_pfn does not overflow\nwhen the entire zone's (and therefore node's) memory map is initialized.\n\n[rppt: massaged the changelog]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/mm_init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3acb913c9d5bd8dcf61677ccba96d349e7681cf8","lessThan":"45489d4f95802903ab35799b400b346fa4e13151","versionType":"git","status":"affected"},{"version":"3acb913c9d5bd8dcf61677ccba96d349e7681cf8","lessThan":"84339578c2d6936ac3a93cd1f0bbaa3468a988f2","versionType":"git","status":"affected"},{"version":"3acb913c9d5bd8dcf61677ccba96d349e7681cf8","lessThan":"97090500d776c3f6d08e857e3a0a7cf092999094","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/mm_init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/45489d4f95802903ab35799b400b346fa4e13151","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/84339578c2d6936ac3a93cd1f0bbaa3468a988f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97090500d776c3f6d08e857e3a0a7cf092999094","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93228","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:18.253","lastModified":"2026-10-21T13:21:05.080","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject Write/Reply chunks with segcount 0\n\nA peer can send a Write or Reply chunk whose segcount field is zero.\nxdr_check_write_chunk() only rejects segcount > rc_maxpages, so zero\npasses the range check, and xdr_inline_decode(stream, 0) returns the\ncurrent (non-NULL) cursor without advancing. The function returns\ntrue and pcl_alloc_write() then links a struct svc_rdma_chunk with\nch_segcount == 0 onto rc_write_pcl or rc_reply_pcl.\n\nAn earlier patch in this series made pcl_for_each_segment() safe for\nch_segcount == 0, so this no longer drives the memory walk it used\nto. Rejecting the malformed frame at the decode boundary is still\nworthwhile as defense in depth: it keeps degenerate zero-segment\nchunks off the parsed chunk lists entirely, so any future consumer\nthat walks ch_segments directly cannot observe one, and it makes the\nzero-floor easy to backport to trees where the macro change is more\nintrusive. RFC 8166 has no meaning for a Write/Reply chunk that\ndescribes no remote buffer, so no legitimate client is affected.\n\nxdr_check_reply_chunk() funnels Reply chunks through\nxdr_check_write_chunk() and inherits the same rejection.\n\npcl_alloc_write() also links each chunk onto the parsed chunk list\nbefore filling its segment array. If a future change weakens the\nsegcount-0 rejection, an incomplete chunk is visible to consumers\nduring the fill loop. Reorder so that list_add_tail() follows the\nsegment fill loop, ensuring only fully-populated chunks appear on\nthe list."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sunrpc/xprtrdma/svc_rdma_pcl.c","net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"78147ca8b4a9b6cf0e597ddd6bf17959e08376c2","lessThan":"28c5a3a572f6cf81ac304459cfd515480995d62a","versionType":"git","status":"affected"},{"version":"78147ca8b4a9b6cf0e597ddd6bf17959e08376c2","lessThan":"fe533ae1bed2ef2b3d54ee7ab410da1874ed3d4f","versionType":"git","status":"affected"},{"version":"78147ca8b4a9b6cf0e597ddd6bf17959e08376c2","lessThan":"a798714b58041e88716db3bf8fb03ae13eecd54a","versionType":"git","status":"affected"},{"version":"78147ca8b4a9b6cf0e597ddd6bf17959e08376c2","lessThan":"45dbdb2637b7fc5f1355b588780d2a7fb0516805","versionType":"git","status":"affected"},{"version":"78147ca8b4a9b6cf0e597ddd6bf17959e08376c2","lessThan":"9808eb7656666acc7291bae9ab6b987bd16e47e0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sunrpc/xprtrdma/svc_rdma_pcl.c","net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/28c5a3a572f6cf81ac304459cfd515480995d62a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/45dbdb2637b7fc5f1355b588780d2a7fb0516805","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9808eb7656666acc7291bae9ab6b987bd16e47e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a798714b58041e88716db3bf8fb03ae13eecd54a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe533ae1bed2ef2b3d54ee7ab410da1874ed3d4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93229","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:18.387","lastModified":"2026-10-19T10:17:13.957","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: add missing read barrier to rpc_status_get dumpit seqcount retry\n\nThe hand-rolled seqcount-like protocol in nfsd_nl_rpc_status_get_dumpit()\nis missing a read memory barrier (smp_rmb) before its second counter\ncheck.  The standard kernel read_seqcount_retry() includes smp_rmb()\nto ensure that all data reads complete before the counter is re-checked.\n\nWithout this barrier, on weakly-ordered architectures (ARM, POWER),\nthe CPU may reorder field reads past the second counter check, making\nthe retry logic ineffective: it could observe a consistent counter pair\nwhile reading fields that have been concurrently modified by the writer.\n\nAdd smp_rmb() before the second counter check to order the field reads\nahead of it, matching the barrier semantics of the standard seqcount\nread-side.  The begin-side smp_load_acquire() already pairs with the\nsmp_store_release() in nfsd_dispatch(); with the smp_rmb() now ordering\nthe field reads, the retry check no longer needs acquire semantics and\nreads the counter with a plain READ_ONCE(), as read_seqcount_retry()\ndoes.\n\n[ cel: Use READ_ONCE instead of smp_load_acquire() ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/nfsd/nfsctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bd9d6a3efa9709e653aafbeb859289feccb8e70c","lessThan":"f501f2f4ec1d2dfe39e21c98630314074a9b30b0","versionType":"git","status":"affected"},{"version":"bd9d6a3efa9709e653aafbeb859289feccb8e70c","lessThan":"1aea0482b98ecd7d0249204665f2ad4ad517f66b","versionType":"git","status":"affected"},{"version":"bd9d6a3efa9709e653aafbeb859289feccb8e70c","lessThan":"9b5f6475006cd8e3b5b99b8eb3cd74dbb1ce9df8","versionType":"git","status":"affected"},{"version":"bd9d6a3efa9709e653aafbeb859289feccb8e70c","lessThan":"a71f161a857117e8e0264deb7d14fff5c98adcf5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/nfsd/nfsctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/1aea0482b98ecd7d0249204665f2ad4ad517f66b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b5f6475006cd8e3b5b99b8eb3cd74dbb1ce9df8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a71f161a857117e8e0264deb7d14fff5c98adcf5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f501f2f4ec1d2dfe39e21c98630314074a9b30b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93230","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:18.517","lastModified":"2026-10-21T13:21:05.430","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier\n\nGigantic bootmem HugeTLB pages are currently initialized from\nhugetlb_init(), but page_alloc_init_late() runs earlier and walks\npageblocks to determine zone contiguity.\n\nIf a bootmem HugeTLB region is marked noinit, set_zone_contiguous() can\nobserve still-uninitialized struct pages through\n__pageblock_pfn_to_page().  This may not trigger an immediate failure, but\nit can make set_zone_contiguous() compute the wrong zone contiguity state.\nIf extra poisoned-page checks are added in this path, such as\nPF_POISONED_CHECK() in page_zone_id(), it can also trigger an early boot\npanic.\n\nInitialize gigantic bootmem HugeTLB struct pages from\npage_alloc_init_late(), before zone contiguity is evaluated, so later page\nallocator setup only sees valid struct page state.  This also makes the\ninitialization order more natural, as struct pages should be initialized\nbefore later code inspects them."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/hugetlb.h","mm/hugetlb.c","mm/mm_init.c","mm/sparse-vmemmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40","lessThan":"326de479ab5942fb4a4aa4f20c716045434fcd6b","versionType":"git","status":"affected"},{"version":"fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40","lessThan":"09505232eced5f1c42902d8f28740f070c3fc6dc","versionType":"git","status":"affected"},{"version":"fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40","lessThan":"29968bc7aefb3cf1e72aa7c5f52697a6b0527094","versionType":"git","status":"affected"},{"version":"fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40","lessThan":"b1b7c045e808c761b1cc8c19b3040fadedda3fef","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/hugetlb.h","mm/hugetlb.c","mm/mm_init.c","mm/sparse-vmemmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/09505232eced5f1c42902d8f28740f070c3fc6dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29968bc7aefb3cf1e72aa7c5f52697a6b0527094","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/326de479ab5942fb4a4aa4f20c716045434fcd6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1b7c045e808c761b1cc8c19b3040fadedda3fef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93231","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:18.637","lastModified":"2026-10-21T13:21:05.710","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlockd: fix swapped arguments in nlmsvc_match_ip()\n\nWhen releasing locks by server IP address via /proc/fs/nfsd/unlock_ip,\nnlmsvc_unlock_all_by_ip() calls nlm_traverse_files() with the server\nsockaddr as the opaque @data argument:\n\n\tnlm_traverse_files(server_addr, nlmsvc_match_ip, NULL);\n\nThe match callback is later invoked from nlm_traverse_locks() as:\n\n\tmatch(lockhost, host);\n\nwhere the first argument is the nlm_host that owns the lock, and the\nsecond argument is the @data that was originally passed down (here the\nserver sockaddr).  This is the convention every other match callback\nrelies on (nlmsvc_mark_host(), nlmsvc_same_host(), nlmsvc_is_client()):\narg1 is the real nlm_host, arg2 is the caller-supplied reference value.\n\nnlmsvc_match_ip() has had these two arguments reversed ever since the\nunlock-by-IP feature was introduced in commit 4373ea84c84d (\"lockd:\nunlock lockd locks associated with a given server ip\"):\n\n\treturn rpc_cmp_addr(nlm_srcaddr(host), datap);\n\nHere @host is actually the server sockaddr, so nlm_srcaddr(host)\ndereferences a struct sockaddr as a struct nlm_host and reads garbage\nat the offset of h_srcaddr; meanwhile @datap is actually the lock\nowner's nlm_host but is compared as a sockaddr.  As a result the\ncomparison practically never matches and locks are not released for the\nrequested IP.\n\nSwap the arguments so the lock owner's source address is compared\nagainst the requested server address:\n\n\treturn rpc_cmp_addr(nlm_srcaddr(datap), (struct sockaddr *)host);\n\n[ cel: fix the misleading typedef parameter names too ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/lockd/lockd.h","fs/lockd/svcsubs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4373ea84c84d8a96e99d3da99e813d3e36d1bd11","lessThan":"4fe2db296c9cd897dd1fe06cc0ae9cbc13beefc5","versionType":"git","status":"affected"},{"version":"4373ea84c84d8a96e99d3da99e813d3e36d1bd11","lessThan":"d34c2ac447fe0490ede828e0143e2cbcb59e6c77","versionType":"git","status":"affected"},{"version":"4373ea84c84d8a96e99d3da99e813d3e36d1bd11","lessThan":"0d72e78c9d38d5377a059a4837f82b65b91cdcf6","versionType":"git","status":"affected"},{"version":"4373ea84c84d8a96e99d3da99e813d3e36d1bd11","lessThan":"21bcb609e0ab1dd60f39ca3498f85808933bcc9f","versionType":"git","status":"affected"},{"version":"4373ea84c84d8a96e99d3da99e813d3e36d1bd11","lessThan":"b9060689f49dc663e9a3d069c4a65ff63a836e66","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/lockd/lockd.h","fs/lockd/svcsubs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.26","status":"affected"},{"version":"0","lessThan":"2.6.26","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0d72e78c9d38d5377a059a4837f82b65b91cdcf6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/21bcb609e0ab1dd60f39ca3498f85808933bcc9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4fe2db296c9cd897dd1fe06cc0ae9cbc13beefc5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9060689f49dc663e9a3d069c4a65ff63a836e66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d34c2ac447fe0490ede828e0143e2cbcb59e6c77","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93232","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:18.767","lastModified":"2026-10-19T10:17:14.263","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages\n\nPatch series \"mm: Refactor bootmem gigantic hugepage allocation\", v4.\n\nThis series is split out from the earlier larger series \"mm: Generalize\nHVO for HugeTLB and device DAX\" [1].  It collects the first 19 patches of\nthat series as a standalone set of fixes and preparatory cleanups around\nbootmem HugeTLB handling, sparse initialization ordering, and related\nvmemmap setup.\n\nThe first patches fix a few bugs found while reviewing the existing code,\nincluding incorrect bootmem HVO handling, wrong vmemmap registration\narguments, a powerpc compound-vmemmap tracking bug, and too-late\ninitialization of gigantic bootmem HugeTLB struct pages.\n\nThe rest of the series reorders early memory initialization so the\nrelevant zone state is available before sparse and HugeTLB boot-time setup\nruns, then simplifies the remaining bootmem gigantic hugepage allocation\npath and removes code made obsolete by that rework.\n\nAt a high level:\n  - patches [1-4] fix boot-time and arch-specific bugs\n  - patches [5-12] reorder and simplify sparse/mm/hugetlb early init\n  - patches [13-19] refactor bootmem gigantic hugepage allocation and\n    remove obsolete helpers and state\n\n\nThis patch (of 19):\n\nCommit 622026e87c40 (\"mm/hugetlb: remove fake head pages\") switched\nHVO to reuse per-zone shared tail pages from zone->vmemmap_tails[].\n\nThose shared tail pages were initialized in hugetlb_vmemmap_init(), but\nbootmem HugeTLB folios are prepared earlier from\ngather_bootmem_prealloc().  With hugetlb_free_vmemmap=on,\nprep_and_add_bootmem_folios() can access pageblock flags on bootmem\nHugeTLB pages whose mirrored tail struct pages already point to the shared\ntail page.  On CONFIG_DEBUG_VM kernels, get_pfnblock_bitmap_bitidx() then\ndereferences the still-uninitialized shared tail page and can panic during\nboot.\n\nInitialize zone->vmemmap_tails[] from gather_bootmem_prealloc(), before\nbootmem HugeTLB folios are processed, and drop the later initialization\nfrom hugetlb_vmemmap_init().\n\nThis bug only affects CONFIG_DEBUG_VM kernels, where the relevant\nassertion is evaluated."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/hugetlb.c","mm/hugetlb_vmemmap.c","mm/sparse-vmemmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"622026e87c4019e609010811757e31193cc23847","lessThan":"2ddf429e25cf8415d9c308f07e64012026bd4d77","versionType":"git","status":"affected"},{"version":"622026e87c4019e609010811757e31193cc23847","lessThan":"c0caeceb0c3899dc42844d3979093b27d1434108","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/hugetlb.c","mm/hugetlb_vmemmap.c","mm/sparse-vmemmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2ddf429e25cf8415d9c308f07e64012026bd4d77","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0caeceb0c3899dc42844d3979093b27d1434108","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93233","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:18.887","lastModified":"2026-10-19T10:17:14.360","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/dmem: fix callocated underflow on large folio split\n\nnouveau_dmem_folio_free() drops chunk->callocated once per freed folio,\nwhile a large (compound) device-private folio is only counted once when\nit is allocated.  When such a folio is split, the mm core invokes\n->folio_split() (nouveau_dmem_folio_split()) once for each new\nsub-folio, but the hook only fixes up the sub-folio metadata and leaves\nchunk->callocated unchanged.\n\nEach resulting sub-folio is later freed separately, so after a split\nthe single allocation (+1) is met by N frees (-N), leaving\nchunk->callocated short by N-1.  On the first split/free cycle it\nunderflows: WARN_ON(!chunk->callocated) fires, the unsigned counter\nwraps and never returns to zero, so the chunk can no longer be\nreclaimed (nouveau_dmem_fini() also warns on the leaked count).\n\nAccount for the new sub-folio in the split hook, under the same lock as\nnouveau_dmem_folio_free(), so the count stays balanced."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/nouveau/nouveau_dmem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c3228747107705d47c7e9a03598a434a0380cb73","lessThan":"0163b92946d0a7c816f619c57a4d9867954dd106","versionType":"git","status":"affected"},{"version":"c3228747107705d47c7e9a03598a434a0380cb73","lessThan":"c2256c044a1df39c8aad4dd2d6f709b2533e2d7a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/nouveau/nouveau_dmem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0163b92946d0a7c816f619c57a4d9867954dd106","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2256c044a1df39c8aad4dd2d6f709b2533e2d7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93234","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.007","lastModified":"2026-10-19T10:17:14.443","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gud: validate TV mode names before creating enum property\n\nThe GUD protocol returns TV mode names as fixed-size\nGUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be\nNUL-terminated.\n\ngud_connector_add_tv_mode() currently passes each fixed-size entry\ndirectly to drm_mode_create_tv_properties_legacy(), which eventually\nreaches drm_property_add_enum() and strlen(). If a device returns an\nentry without a terminating NUL byte, strlen() reads past the end of\nthe slot and can run beyond the allocated buffer, triggering an\nout-of-bounds read.\n\nValidate that each returned TV mode name contains a NUL terminator\nwithin its fixed-size slot before passing it to the DRM property code.\nIf a malformed entry is found, reject the device response with -EIO.\n\nThis fixes the out-of-bounds read without changing the handling of\nvalid devices, and avoids silently truncating malformed protocol data."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/gud/gud_connector.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"676f1fb3632bbc9ce83be7938e93fe6bfc9510fd","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"06fcaf21c18ac88f57fee3803554f48c6026b95f","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"082e378886547b5b1c4075ed307f7c68547868dc","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"70cffc31a380b3eae45027101647aa94c242aa0e","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"72a95df6bbc7d20c7af1e39d86b3e910cccd01ad","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"eab46d9629807db1b5647d17227e16110a18227f","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"da1ea35fea67ad841f4ada28dd61b41be65e5437","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/gud/gud_connector.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/06fcaf21c18ac88f57fee3803554f48c6026b95f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/082e378886547b5b1c4075ed307f7c68547868dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/676f1fb3632bbc9ce83be7938e93fe6bfc9510fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/70cffc31a380b3eae45027101647aa94c242aa0e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72a95df6bbc7d20c7af1e39d86b3e910cccd01ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da1ea35fea67ad841f4ada28dd61b41be65e5437","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eab46d9629807db1b5647d17227e16110a18227f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93235","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.150","lastModified":"2026-10-19T10:17:14.553","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to zero post-EOF data when extending file size\n\ngeneric/794  4s ... - output mismatch (see /share/git/fstests/results//generic/794.out.bad)\n    --- tests/generic/794.out   2026-06-12 08:46:32.766426241 +0800\n    +++ /share/git/fstests/results//generic/794.out.bad 2026-07-05 18:32:55.000000000 +0800\n    @@ -1,4 +1,16 @@\n     QA output created by 794\n     append_write\n    +FAIL: non-zero data in gap [4080,4096) after shutdown+remount\n    +000000 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  >ZZZZZZZZZZZZZZZZ<\n    +*\n    +001000\n     truncate_up\n    ...\n    (Run 'diff -u /share/git/fstests/tests/generic/794.out /share/git/fstests/results//generic/794.out.bad'  to see the entire diff)\nRan: generic/794\nFailures: generic/794\nFailed 1 of 1 tests\n\nSteps of generic/794:\n1. write 4096 bytes to file w/ 0x5a\n2. use fiemap to get PBA of first block in file\n3. truncate file to 4080\n4. umount; write 4096 bytes to file w/ 0x5a directly via PBA; mount\n5. extend filesize via\n   a) append 4096 from offset 4096, or\n   b) truncate 8192, or\n   c) fallocate 4096 from offset 4096\n6. verify the gap is zeroed in memory [4080,4096)\n7. sync range 4096 from offset 4096; shutdown -f (flush meta before shutdown)\n8. umount; mount; verify [4080,4096) is zeroed or not.\n\nWhen extending file size (e.g. via truncate, fallocate, or write) across an\nunaligned EOF boundary, we need to ensure that post-EOF data in the partial\npage is zeroed out in pagecache and marked dirty, then writeback the cache to\npersist zeroed data before committing inode w/ updated i_size.\n\nThis help to prevent stale disk data beyond the previous EOF from being exposed\nafter remounting or crash recovery.\n\nSince f2fs is a LFS filesystem, we only support direct write via PBA in pinfile,\nand pinfile has section-aligned filesize, so in Android, there should no problem,\nbut for other usage in different environment, let's fix this w/ fsync_mode=strict\nmount option."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/f2fs/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a","lessThan":"6882d458d2e403f6ba7b45542dd31a6b7531eb2e","versionType":"git","status":"affected"},{"version":"fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a","lessThan":"32c7f11a24268ba8d3bb50ea7f54d33f698cd253","versionType":"git","status":"affected"},{"version":"fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a","lessThan":"91ec55ddc097ccddd25ffb95a3d079b2ef362372","versionType":"git","status":"affected"},{"version":"fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a","lessThan":"c42608c09b6b5d5967bf211c255914c068c2cde1","versionType":"git","status":"affected"},{"version":"fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a","lessThan":"5eced87b7d19dbc76ebdddaf322046f9ac582fcb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/f2fs/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.8","status":"affected"},{"version":"0","lessThan":"3.8","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/32c7f11a24268ba8d3bb50ea7f54d33f698cd253","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5eced87b7d19dbc76ebdddaf322046f9ac582fcb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6882d458d2e403f6ba7b45542dd31a6b7531eb2e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91ec55ddc097ccddd25ffb95a3d079b2ef362372","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c42608c09b6b5d5967bf211c255914c068c2cde1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93236","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.297","lastModified":"2026-10-19T10:17:14.663","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common\n\nWhen VIDIOC_TRY_FMT is called with an unsupported pixel format on the\nOUTPUT queue, vdec_try_fmt_common() falls back to V4L2_PIX_FMT_MPEG2.\nHowever, if a distro has locally patched MPEG2 support out (as it has\nbeen broken for some time) the platform format table does not contain\nMPEG2 so find_format() returns NULL and the subsequent dereference of\nfmt_out->max_width triggers a NULL pointer dereference.\n\nFix this by falling back to the first format in the platform's format\narray instead of hardcoding V4L2_PIX_FMT_MPEG2. This is always valid\nsince every platform defines at least one format."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/media/meson/vdec/vdec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"276f28672bb6d5d5feca78db4219c7b5adf1be26","versionType":"git","status":"affected"},{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"c620906fb1b2ad75d408ea9d06040d66952d4a31","versionType":"git","status":"affected"},{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"3839b6be2279fc4f558723f2c0fbfc9c42070958","versionType":"git","status":"affected"},{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"680a89683197cdfe4e03e6fd7755454c647d39c1","versionType":"git","status":"affected"},{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"f2375a308640e401c142c5426d52c3d10e016d25","versionType":"git","status":"affected"},{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"96dafbae77f50bfe2228bcfedcd8652c5e5f08e8","versionType":"git","status":"affected"},{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"d61ba609c3226af3c84268ba606ea06ee63e511b","versionType":"git","status":"affected"},{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"20aa934ace6917262ff579a73ec018d06a7bad1c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/media/meson/vdec/vdec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/20aa934ace6917262ff579a73ec018d06a7bad1c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/276f28672bb6d5d5feca78db4219c7b5adf1be26","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3839b6be2279fc4f558723f2c0fbfc9c42070958","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/680a89683197cdfe4e03e6fd7755454c647d39c1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96dafbae77f50bfe2228bcfedcd8652c5e5f08e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c620906fb1b2ad75d408ea9d06040d66952d4a31","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d61ba609c3226af3c84268ba606ea06ee63e511b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2375a308640e401c142c5426d52c3d10e016d25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93237","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.447","lastModified":"2026-10-19T10:17:14.793","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Add DIRECT_MAP_PHYSMEM_END definition\n\nget_free_mem_region() and mhp_get_pluggable_range() bound their search\nto DIRECT_MAP_PHYSMEM_END. LoongArch does not define it, so the fallback\nin include/linux/mm.h applies: under CONFIG_SPARSEMEM_VMEMMAP it is\n(1ULL << MAX_PHYSMEM_BITS) - 1, a compile-time constant that does not\nadapt to the CPU's physical address space bits (cpu_pabits, probed from\nCPUCFG1).\n\nThe vmemmap window only covers physical space below 2^(cpu_pabits+1)\n(i.e. VMEMMAP_SIZE), so on CPUs with fewer physical address bits than\nMAX_PHYSMEM_BITS the fallback allows get_free_mem_region() to return\na ZONE_DEVICE region outside the vmemmap window; vmemmap_populate() then\nwraps the memmap range around and maps it into low memory, silently\ncorrupting the page tables. The same search also picked the top-of-\naddress-space region that crashed memmap_init_zone_device() with amdkfd\non Loongson-3C6000 in 6.16 [1]; the commit 2969b42c8f99 (\"LoongArch/mm:\nalign vmemmap to maximal folio size\") keeps that region in bounds on\ncurrent Loongson-3C6000 configs, but CPUs with smaller cpu_pabits (e.g.\nthe Loongson-2K series) are still affected.\n\nDefine DIRECT_MAP_PHYSMEM_END as the vmemmap-covered physical range,\n(1ULL << (cpu_pabits + 1)) - 1, capped at (1ULL << MAX_PHYSMEM_BITS) - 1\nunder CONFIG_SPARSEMEM, similar to the commit f3336b48cf9d (\"riscv: mm:\nDefine DIRECT_MAP_PHYSMEM_END\").\n\n[1] https://lore.kernel.org/amd-gfx/20250814032153.227285-1-jeffbai@aosc.io/"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/loongarch/include/asm/pgtable.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7b09f5af01ede480cbe7abcb281cf17550a46ff5","lessThan":"ab275a23b4d9f04ca6c2f5f6a3246194e045a761","versionType":"git","status":"affected"},{"version":"7b09f5af01ede480cbe7abcb281cf17550a46ff5","lessThan":"55e18311c705cceef6c34d522ea387b1f0069bab","versionType":"git","status":"affected"},{"version":"7b09f5af01ede480cbe7abcb281cf17550a46ff5","lessThan":"2677f97a67fdbc62a82ce1faa67791f54451d36f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/loongarch/include/asm/pgtable.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2677f97a67fdbc62a82ce1faa67791f54451d36f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55e18311c705cceef6c34d522ea387b1f0069bab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab275a23b4d9f04ca6c2f5f6a3246194e045a761","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93238","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.563","lastModified":"2026-10-19T10:17:14.913","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap\n\nThe DECLARE_BITMAP(apm_filtered, AP_DEVICES) macro allocates the bitmap\non the stack without zero-initializing it.\n\nIn vfio_ap_mdev_hot_plug_cfg(), the vfio_ap_mdev_filter_matrix() function\nis only called to initialize and populate apm_filtered if either\nfilter_adapters or filter_domains is true. If the hot plug configuration\nchange only adds control domains (meaning filter_cdoms is true, but\nfilter_adapters and filter_domains are both false),\nvfio_ap_mdev_filter_matrix() is bypassed.\n\nConsequently, apm_filtered is passed to reset_queues_for_apids() with\nuninitialized stack garbage. This can cause reset_queues_for_apids() to\ninterpret arbitrary stack garbage bits as valid APIDs to reset, potentially\nperforming unintended guest hardware queue resets.\n\nFix this by zero-initializing the apm_filtered bitmap at the beginning of\nvfio_ap_mdev_hot_plug_cfg() using bitmap_zero()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/s390/crypto/vfio_ap_ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"eeb386aeb5b7c8d2dae6a3ba49255d8a97803182","lessThan":"4ba8a08f5f26ed59f356a6318bca3aa7cc0af3e2","versionType":"git","status":"affected"},{"version":"eeb386aeb5b7c8d2dae6a3ba49255d8a97803182","lessThan":"f73db632524320d2b93bc8534be8ea875053502d","versionType":"git","status":"affected"},{"version":"eeb386aeb5b7c8d2dae6a3ba49255d8a97803182","lessThan":"6d554f2571e6b4db242593ba561efd6a6d1f99a9","versionType":"git","status":"affected"},{"version":"eeb386aeb5b7c8d2dae6a3ba49255d8a97803182","lessThan":"09548edc6114f1eb1035b30795e893204ef45b85","versionType":"git","status":"affected"},{"version":"eeb386aeb5b7c8d2dae6a3ba49255d8a97803182","lessThan":"bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/s390/crypto/vfio_ap_ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/09548edc6114f1eb1035b30795e893204ef45b85","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4ba8a08f5f26ed59f356a6318bca3aa7cc0af3e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d554f2571e6b4db242593ba561efd6a6d1f99a9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f73db632524320d2b93bc8534be8ea875053502d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93239","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.690","lastModified":"2026-10-19T10:17:15.017","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: mm: Fix the lockless page-table walk in show_pte()\n\nshow_pte() walks page tables locklessly and can run with interrupts\nenabled. A concurrent teardown can free a table page while it is being\nwalked. It can also clear a parent entry after show_pte() checked it; the\nregular pXd_offset() helpers then reread the cleared entry and can derive a\nbogus lower-level pointer and fault again.\n\nUse the lockless offset helpers with the saved parent entries, as\ngup_fast() does, and pass the saved PMD to pte_offset_map().\n\nFor task page tables, arm64 selects MMU_GATHER_RCU_TABLE_FREE. Disable\nlocal interrupts around the walk to hold off RCU-deferred table frees and\nblock the tlb_remove_table_sync_one() IPI until the walk is finished.\n\nPlace the IRQ guard after the header print. This does not make the output a\nconsistent snapshot, but prevents the task page-table walk from\ndereferencing a released table page or deriving a pointer from a different\nparent value."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/mm/fault.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","lessThan":"08d931a0a850ad16a64f2cd23a19f40795cdbdf7","versionType":"git","status":"affected"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","lessThan":"b28fe65a36b8209b6adcf2722c7ce974cf9ac8d1","versionType":"git","status":"affected"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","lessThan":"68cbd70795dd8c06e7ccdc4eb0b74c5b180076c3","versionType":"git","status":"affected"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","lessThan":"0f05d95b99164a9ccc4cf4a4920e0ff0228138ad","versionType":"git","status":"affected"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","lessThan":"a77644d009dece1104b6fcc6e322b0e4503db0d6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/mm/fault.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.7","status":"affected"},{"version":"0","lessThan":"3.7","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/08d931a0a850ad16a64f2cd23a19f40795cdbdf7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0f05d95b99164a9ccc4cf4a4920e0ff0228138ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68cbd70795dd8c06e7ccdc4eb0b74c5b180076c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a77644d009dece1104b6fcc6e322b0e4503db0d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b28fe65a36b8209b6adcf2722c7ce974cf9ac8d1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93240","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.827","lastModified":"2026-10-21T13:21:05.993","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: make the v1 soft limit knob inert\n\nThe v1 soft limit has been deprecated since v6.12 and nobody has reported\ndepending on it.  Start the removal by decoupling the interface from the\nimplementation: keep memory.soft_limit_in_bytes, but ignore writes to it\nand always report the maximum value on read similar to what\nmemory.kmem.limit_in_bytes already does.\n\nWrites are still parsed, so malformed input keeps returning -EINVAL.  The\nknob now also behaves the same everywhere: it used to return -EOPNOTSUPP\non PREEMPT_RT, where soft limit reclaim has always been disabled.\n\nThis also fixes the syzbot report linked below.  Soft limit reclaim is the\nonly caller that runs shrink_lruvec() from kswapd against a specific\nmemcg, so it is the only way to reach lru_gen_shrink_lruvec() and in turn\nset_mm_walk(), which warns when called from kswapd."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["Documentation/admin-guide/cgroup-v1/memory.rst","mm/memcontrol-v1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e9d4e1ee788097484606c32122f146d802a9c5fb","lessThan":"bf75f14d755f9cfbb246e6cc011b53cdd5142de3","versionType":"git","status":"affected"},{"version":"e9d4e1ee788097484606c32122f146d802a9c5fb","lessThan":"72fb67f6e0e5d78e4f34cf9929d1afdb0fd54203","versionType":"git","status":"affected"},{"version":"e9d4e1ee788097484606c32122f146d802a9c5fb","lessThan":"0a90e268cce7023f34087bfa4affb42e29ff5f45","versionType":"git","status":"affected"},{"version":"e9d4e1ee788097484606c32122f146d802a9c5fb","lessThan":"5ec8f629a300cc40e746d6178f724bdff7683fa7","versionType":"git","status":"affected"},{"version":"e9d4e1ee788097484606c32122f146d802a9c5fb","lessThan":"a3417097fb107cea3358b19bcbb4eb655fd67f8c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["Documentation/admin-guide/cgroup-v1/memory.rst","mm/memcontrol-v1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0a90e268cce7023f34087bfa4affb42e29ff5f45","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ec8f629a300cc40e746d6178f724bdff7683fa7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72fb67f6e0e5d78e4f34cf9929d1afdb0fd54203","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3417097fb107cea3358b19bcbb4eb655fd67f8c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf75f14d755f9cfbb246e6cc011b53cdd5142de3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93241","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.953","lastModified":"2026-10-19T10:17:15.210","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done\n\nAt Meta, we are seeing instances where an OOM killed job is stuck in the\nexit path for several hours.  In one particular case, the job was stuck\nfor more than 8 hours and I had to manually remove the memory.max limits\nto allow the process to exit.\n\nThe job was a single process job and had ~55 GiB memory.max and zswap\nenabled.  It had almost 0 anon in memory and ~111 GiB in zswap compressed\nto ~51 GiB zswap pool (i.e.  almost all of memory.current was zswap). \nNothing was left on the LRUs to reclaim.\n\nOn further inspection, I observed ~20k threads of that process stuck with\nthe following stack:\n\n[<0>] mem_cgroup_out_of_memory+0x4e/0xa0\n[<0>] charge_memcg+0x8bf/0x990\n[<0>] mem_cgroup_swapin_charge_folio+0x4e/0x80\n[<0>] __read_swap_cache_async+0x10c/0x260\n[<0>] swapin_readahead+0x116/0x3f0\n[<0>] do_swap_page+0x13c/0x1ce0\n[<0>] handle_mm_fault+0x61d/0x11f0\n[<0>] do_user_addr_fault+0x3e7/0x6d0\n[<0>] exc_page_fault+0x8f/0x110\n[<0>] asm_exc_page_fault+0x22/0x30\n[<0>] __get_user_8+0x14/0x20\n[<0>] futex_cleanup+0x27/0x1c0\n[<0>] futex_exit_release+0x47/0x60\n[<0>] do_exit+0x107/0x940\n[<0>] do_group_exit+0x81/0xa0\n[<0>] get_signal+0x2b1/0x6e0\n[<0>] arch_do_signal_or_restart+0x1a/0x1c0\n[<0>] exit_to_user_mode_loop+0xa8/0x1c0\n[<0>] do_syscall_64+0x152/0x250\n[<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nIn addition the dmesg was filled with \"Out of memory and no killable\nprocesses...\" messages.\n\nI have no idea why oom reaper was not able to reap/unmap the process.  My\nguess is that since oom reaper tries to acquire mmap_lock in read mode\nlimited number of times and then gives up, there might be a thread of that\nprocess which had mmap_lock in write mode at that time.\n\nMy initial suspicion was the futex_cleanup and kernel page fault causing\ninfinite fault and charge retries but that was put to rest in previous\ndiscussions happened on similar problem [1].\n\nMy current theory is that it is just a simple slow serialization behind\nthe oom_lock.  Unlike page allocator, memcg charge code takes the oom_lock\nwithout the \"try\".  Though memcg oom code uses mutex_lock_killable(), note\nthat in the call stack get_signal() consumes SIGKILL (or\nsigdelset(SIGKILL)) before calling do_group_exit().  So this\nmutex_lock_killable() is just a mutex_lock() here.  Therefore 10s of\nthousands of threads are waiting on oom_lock and one by one they get\n-EFAULT from get_user() in the futex cleanup code and bails out.\n\nDiscussion from [1] led to commit a75ffa26122b (\"memcg, oom: do not bypass\noom killer for dying tasks\") which routes dying tasks into the OOM path\nprecisely so the oom_reaper can reap their mm and free the memory\nasynchronously.  But the reaper is best-effort and one-shot: if it cannot\ntake mmap_lock for read (e.g.  a sibling thread holds it for write) it\nsets MMF_OOM_SKIP and never retries, leaving only the glacial\noom_lock-serialized synchronous drain.\n\nOnce MMF_OOM_SKIP is set there is no more asynchronous reclaim coming for\nthe mm, so a dying task charging against it has nothing left to wait for:\nit frees its memory only once it finishes exiting.  Running reclaim and\nthe (no-victim) OOM killer for it is then pointless, and doing it for 10s\nof thousands of exiting threads is what serializes them behind oom_lock. \nSo before reclaim, if current is an OOM victim whose reaper is done, fail\nthe charge.\n\nReproduced with 20k threads, each parking a robust futex head on its own\nzswapped page, OOM-group-killed while a sibling holds mmap_lock for write\nso the reaper gives up and sets MMF_OOM_SKIP.  Tested on next-20260728 and\nbaseline show ~90 seconds exit time while with the patch the exit time\nreduced to ~3 seconds."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/memcontrol.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a75ffa26122bba4a3fa9372aa13b32d7a5590425","lessThan":"801bcbdbfd595cc7f0de95f2802b5596c8971315","versionType":"git","status":"affected"},{"version":"a75ffa26122bba4a3fa9372aa13b32d7a5590425","lessThan":"d44c3c5986c7a4a5f913a813e18cda08a838f91b","versionType":"git","status":"affected"},{"version":"a75ffa26122bba4a3fa9372aa13b32d7a5590425","lessThan":"6b0d1083364fc8e7cc2f7d1f93ee3ee78f4d52f7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/memcontrol.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6b0d1083364fc8e7cc2f7d1f93ee3ee78f4d52f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/801bcbdbfd595cc7f0de95f2802b5596c8971315","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d44c3c5986c7a4a5f913a813e18cda08a838f91b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93242","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:20.090","lastModified":"2026-10-19T10:17:15.323","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()\n\nqla24xx_process_response_queue() advances ring_ptr past the head IOCB\nbefore dispatching, so by the time __qla_consume_iocb() runs, ring_ptr\nalready points at the first continuation IOCB. The function however\nlooped purex->entry_count times starting at ring_ptr. As entry_count\nincludes the head, this consumed one entry too many: it stamped\nRESPONSE_PROCESSED on the next, unrelated IOCB and advanced the ring\npast it, silently dropping a legitimate firmware response. The head\nIOCB's signature was also never marked.\n\nMark the head processed and account for it, then consume only the\nentry_count - 1 continuation IOCBs, matching __qla_copy_purex_to_buffer()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/qla2xxx/qla_isr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fac2807946c10b9a509b9c348afd442fa823c5f7","lessThan":"a136c311676fd1010b1bde3bcfd410caa2fa040f","versionType":"git","status":"affected"},{"version":"fac2807946c10b9a509b9c348afd442fa823c5f7","lessThan":"d841707fafba5f80341b82e8c3a4c24fc5aa5132","versionType":"git","status":"affected"},{"version":"fac2807946c10b9a509b9c348afd442fa823c5f7","lessThan":"6e3f129538c32d0019437197735912308c161843","versionType":"git","status":"affected"},{"version":"fac2807946c10b9a509b9c348afd442fa823c5f7","lessThan":"bd1534d4afab47f13dfc27fff6f59dd859a0ac3a","versionType":"git","status":"affected"},{"version":"fac2807946c10b9a509b9c348afd442fa823c5f7","lessThan":"31715d1e1cbf3a37ce3452635c5602f73fd7abd4","versionType":"git","status":"affected"},{"version":"fac2807946c10b9a509b9c348afd442fa823c5f7","lessThan":"df86c27cf1ba9d66f737a1fa56479c6e7efafe4e","versionType":"git","status":"affected"},{"version":"fac2807946c10b9a509b9c348afd442fa823c5f7","lessThan":"3ba019bdd89d931499d9476456b5d9c7ab7fa753","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/qla2xxx/qla_isr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/31715d1e1cbf3a37ce3452635c5602f73fd7abd4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3ba019bdd89d931499d9476456b5d9c7ab7fa753","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e3f129538c32d0019437197735912308c161843","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a136c311676fd1010b1bde3bcfd410caa2fa040f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd1534d4afab47f13dfc27fff6f59dd859a0ac3a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d841707fafba5f80341b82e8c3a4c24fc5aa5132","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df86c27cf1ba9d66f737a1fa56479c6e7efafe4e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93243","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:20.230","lastModified":"2026-10-21T13:21:06.283","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/secretmem: properly account locked pages\n\nsecretmem accounts folios by treating memory as if it were mlock()'d and\nthus limited by the RLIMIT_MEMLOCK limit.\n\nHowever the folios are unevictable and remain so until the inode is\nevicted, eliminating usual mlock() semantics - mapping folios then\nunmapping them does not clear their unevictable state, since it depends on\nAS_UNEVICTABLE, not PG_mlocked.\n\nA user can therefore easily work around the RLIMIT_MEMLOCK limit - simply\nmap then unmap and VmLck no longer counts the secretmem range.  Worse,\nfolios are not accounted in the process's RSS, meaning the OOM killer\nwon't know to kill the process.\n\nRepeatedly mapping/unmapping (or forking) can then result in the\nconsumption of all available system memory with unevictable folios and\ncause system instability.\n\nA secretmem fd can be passed between processes and over fork so a\nper-process limit simply does not make sense, so follow the precedent set\nby io_uring, perf, skbuff, iommufd and xdp by tracking the number of\nlocked pages in user_struct->locked_vm.\n\nSince the scope tracked is actually inode lifetime, the RLIMIT_MEMLOCK\napplies per-user not per-process, so it doesn't make sense to bypass for\nusers with CAP_IPC_LOCK, therefore remove this bypass.\n\nThere is simply no reason to carry on marking the mapping as mlock()'d\nsince it's misleading and the lifecycle is now correctly handled, so\nremove this too.\n\nNote that secretmem does not support any form of truncation (including\nhole punching) and the folios are unreclaimable, so the folios need only\nbe accounted on fault and unaccounted on inode destruction.\n\n__secretmem_account_pages() is more or less a duplicate of the code that\nio_uring etc.  use, but since this is a bug fix that needs backporting,\ndefer any de-duplication efforts to a follow-up.\n\ntest_mlock_limit() asserts mlock_future_ok() on mmap(), however this has\nbeen removed, so remove the test altogether for the fix.  A new test will\nbe sent separately for upstream."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/sched/user.h","mm/secretmem.c","tools/testing/selftests/mm/memfd_secret.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1507f51255c9ff07d75909a84e7c0d7f3c4b2f49","lessThan":"51fba083e454f901947d6a335eeff671171d4714","versionType":"git","status":"affected"},{"version":"1507f51255c9ff07d75909a84e7c0d7f3c4b2f49","lessThan":"a41c95ac90f285cbe473b9606428b14518896ea4","versionType":"git","status":"affected"},{"version":"1507f51255c9ff07d75909a84e7c0d7f3c4b2f49","lessThan":"853043cb129473ff2fa0090602be944d96b9d5c9","versionType":"git","status":"affected"},{"version":"1507f51255c9ff07d75909a84e7c0d7f3c4b2f49","lessThan":"3b4f72bdddff69819d665395376329ef21f37a06","versionType":"git","status":"affected"},{"version":"1507f51255c9ff07d75909a84e7c0d7f3c4b2f49","lessThan":"97d34aa65c29cca85e3e9050f4c936389b38a054","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/sched/user.h","mm/secretmem.c","tools/testing/selftests/mm/memfd_secret.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.113","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3b4f72bdddff69819d665395376329ef21f37a06","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/51fba083e454f901947d6a335eeff671171d4714","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/853043cb129473ff2fa0090602be944d96b9d5c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97d34aa65c29cca85e3e9050f4c936389b38a054","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a41c95ac90f285cbe473b9606428b14518896ea4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93244","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:20.360","lastModified":"2026-10-21T13:21:06.577","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sysfb: simpledrm: Improve stride validation\n\nValidate the computed stride against the maximum value INT_MAX."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/sysfb/simpledrm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7bfa5c7b28d66d89daf0808bf36ab7fe0e9e93a1","lessThan":"110dd054fd4af97fc3f47d7df9a016b07122cc04","versionType":"git","status":"affected"},{"version":"7bfa5c7b28d66d89daf0808bf36ab7fe0e9e93a1","lessThan":"b09d27caf49ff584dbafdba3bb95487a75cb8824","versionType":"git","status":"affected"},{"version":"7bfa5c7b28d66d89daf0808bf36ab7fe0e9e93a1","lessThan":"6892f0a2f6b5990b9572ba043dd14dd4df6bb3f0","versionType":"git","status":"affected"},{"version":"7bfa5c7b28d66d89daf0808bf36ab7fe0e9e93a1","lessThan":"bbdc6761c55662fb9ddf5ab580acb616131998fe","versionType":"git","status":"affected"},{"version":"7bfa5c7b28d66d89daf0808bf36ab7fe0e9e93a1","lessThan":"df6533f11688aa30be3bb883c7637f4ffdbb7cbd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/sysfb/simpledrm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/110dd054fd4af97fc3f47d7df9a016b07122cc04","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6892f0a2f6b5990b9572ba043dd14dd4df6bb3f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b09d27caf49ff584dbafdba3bb95487a75cb8824","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bbdc6761c55662fb9ddf5ab580acb616131998fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df6533f11688aa30be3bb883c7637f4ffdbb7cbd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93245","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:20.473","lastModified":"2026-10-19T10:17:15.633","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: policy_int make sure list heads are initialized before fail path\n\nIf profile create fails before policy_init is complete the list heads\nare not properly initialized causing profile_free() sanity checks to\ntrigger the following splat.\n\nAppArmor WARN aa_policy_destroy: (((!list_empty(&policy->profiles) && (&policy->profiles)->prev != ((void *) 0x122 + (0xdead000000000000UL))))):\nWARNING: security/apparmor/lib.c:509 at aa_policy_destroy+0x164/0x1b0 security/apparmor/lib.c:509, CPU#0: syz.0.17/5541\nModules linked in:\nCPU: 0 UID: 0 PID: 5541 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:aa_policy_destroy+0x16b/0x1b0 security/apparmor/lib.c:509\nCode: 85 ed 7e 4d e8 96 bc 37 fd 5b 41 5c 41 5e 41 5f 5d e9 19 27 4e 07 cc e8 83 bc 37 fd 48 8d 3d 0c f0 d3 0b 48 c7 c6 a4 eb 38 8e <67> 48 0f b9 3a e9 04 ff ff ff e8 66 bc 37 fd 48 8d 3d ff ef d3 0b\nRSP: 0018:ffffc9000345eaa0 EFLAGS: 00010293\nRAX: ffffffff848f530d RBX: ffff88803f734800 RCX: ffff88801af2a580\nRDX: 0000000000000000 RSI: ffffffff8e38eba4 RDI: ffffffff90634320\nRBP: 0000000000000000 R08: 0000000000000cc0 R09: 00000000ffffffff\nR10: dffffc0000000000 R11: fffffbfff1d95913 R12: dead000000000122\nR13: ffff88803f734800 R14: ffff88803f734828 R15: dffffc0000000000\nFS:  00007f5f6a1836c0(0000) GS:ffff88808c519000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055d02407b048 CR3: 0000000012aa9000 CR4: 0000000000352ef0\nCall Trace:\n <TASK>\n aa_free_profile+0x9d/0x9f0 security/apparmor/policy.c:334\n aa_alloc_profile+0x1e4/0x3e0 security/apparmor/policy.c:416\n unpack_profile security/apparmor/policy_unpack.c:1153 [inline]\n aa_unpack+0x17db/0x7430 security/apparmor/policy_unpack.c:1748\n aa_replace_profiles+0x226/0x2a20 security/apparmor/policy.c:1183\n policy_update+0x234/0x4a0 security/apparmor/apparmorfs.c:505\n profile_load+0x1cb/0x320 security/apparmor/apparmorfs.c:522\n vfs_write+0x296/0xba0 fs/read_write.c:685\n ksys_write+0x150/0x270 fs/read_write.c:739\n do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]\n do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f5f6939e0d9\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f5f6a183028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 00007f5f69625fa0 RCX: 00007f5f6939e0d9\nRDX: 0000000000000041 RSI: 0000200000000400 RDI: 0000000000000003\nRBP: 00007f5f6a183090 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001\nR13: 00007f5f69626038 R14: 00007f5f69625fa0 R15: 00007ffe23725c18"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/apparmor/lib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"88ba930e7d0586ca2700757249f1e6fc0bbab0fc","versionType":"git","status":"affected"},{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"ee017ef9aa2cf20d85d4a20c09ef3db9fb240310","versionType":"git","status":"affected"},{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"62f159fac76468dbbfd977f4f18472d4a01e8d74","versionType":"git","status":"affected"},{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"0664c75afe87a1d7d4f4e1d7eecf50ad829fb6e8","versionType":"git","status":"affected"},{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"4a09a5e6512a3792c78ae8e3ca79cb55a11eed57","versionType":"git","status":"affected"},{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"5449f715f24e86648f8cc8fba8d97ff6b5d04981","versionType":"git","status":"affected"},{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"dd52ab1c5436be86f5b8ca118fa8e5d61d63ffed","versionType":"git","status":"affected"},{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"3daad923a8685adb66087e0d819559b7eb6ba975","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/apparmor/lib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.11","status":"affected"},{"version":"0","lessThan":"4.11","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0664c75afe87a1d7d4f4e1d7eecf50ad829fb6e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3daad923a8685adb66087e0d819559b7eb6ba975","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a09a5e6512a3792c78ae8e3ca79cb55a11eed57","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5449f715f24e86648f8cc8fba8d97ff6b5d04981","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62f159fac76468dbbfd977f4f18472d4a01e8d74","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/88ba930e7d0586ca2700757249f1e6fc0bbab0fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd52ab1c5436be86f5b8ca118fa8e5d61d63ffed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee017ef9aa2cf20d85d4a20c09ef3db9fb240310","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93246","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:20.647","lastModified":"2026-10-19T10:17:15.767","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: fix out-of-bounds read setting MSI-X irq affinity\n\nrvu_register_interrupts() walks every MSI-X vector and uses strstr()\nto match \"Mbox\" or \"FLR\" in irq_name before pinning those interrupts\nto CPU 0. irq_name is a per-vector NAME_SIZE buffer, but not every\nslot is populated before this loop runs. strstr() keeps scanning until\nit finds a NUL terminator, so an uninitialized slot can trigger a KASAN\nslab-out-of-bounds read at boot when debug options are enabled.\n\nUse strnstr() with NAME_SIZE to bound the search within each vector's\nname buffer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/marvell/octeontx2/af/rvu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4e527f1e5c155ce28164ba34cad47b635d16f827","lessThan":"2f460aa0211e97c011ef0cfe5016f8f2a2ed059b","versionType":"git","status":"affected"},{"version":"4e527f1e5c155ce28164ba34cad47b635d16f827","lessThan":"4d5df98369c5f45710b786499f8bd7ffc3196433","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/marvell/octeontx2/af/rvu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2f460aa0211e97c011ef0cfe5016f8f2a2ed059b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4d5df98369c5f45710b786499f8bd7ffc3196433","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93247","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:20.803","lastModified":"2026-10-19T10:17:15.900","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference\n\n'uuid_count' member of struct 'discovery_state' is assigned and read\nwithout any locks, so there is a chance of situation when\nuuid_count != 0, but uuids is NULL and there will be NULL pointer\ndereference.\n\nPossible race:\n'hci_update_passive_scan_sync'\n  'hci_discovery_filter_clear'\n    hdev->discovery.uuid_count = 0;\n      <----------------------preempted----------------------------->\n                        'start_service_discovery'\n                          // Set uuid_count to value != 0\n                          hdev->discovery.uuid_count = uuid_count;\n                          hdev->discovery.uuids = kmemdup(...);\n      <----------------------preempted----------------------------->\n    spin_lock(&hdev->discovery.lock);\n    kfree(hdev->discovery.uuids);\n    hdev->discovery.uuids = NULL;\n    spin_unlock(&hdev->discovery.lock);\n\nNow uuids == NULL and uuid_count != 0.\nSo 'mgmt_device_found' -> 'is_filter_match' -> 'eir_has_uuids' receives\nnon consistent discovery state, where NULL dereference of uuids happens.\n\nTo fix it let's add discovery.lock around every read/write of uuid_count,\nuuids pair of struct members. It is also important to assign uuid_count\nvalue only after success kmemdup() allocation in\nstart_service_discovery(), otherwise uuids is NULL, because kmemdup failed,\nbut uuid_count is already assigned to non zero value.\n\nThe following panic happens:\n\n[ ] ------------[ cut here ]------------\n[ ] Unable to handle kernel NULL pointer dereference at virtual\naddress 0000000000000000\n[ ] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP\n[ ] CPU: 0 PID: 15056 Comm: kworker/u9:2\n[ ] Workqueue: hci0 hci_rx_work\n[ ] pstate: 10400009 (nzcV daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ ] pc : eir_has_uuids+0x2d8/0x590\n[ ] lr : is_filter_match+0x258/0x320\n...\n[ ] Call trace:\n[ ]  eir_has_uuids+0x2d8/0x590\n[ ]  is_filter_match+0x258/0x320\n[ ]  mgmt_device_found+0x5b0/0xafc\n[ ]  process_adv_report.part.0+0x8c8/0xf14\n[ ]  hci_le_adv_report_evt+0x338/0x3f0\n[ ]  hci_le_meta_evt+0x1f0/0x4c8\n[ ]  hci_event_packet+0x440/0xc9c\n[ ]  hci_rx_work+0x44c/0xaf8\n[ ]  process_one_work+0x54c/0x103c\n[ ]  worker_thread+0x6c4/0x10c4\n[ ]  kthread+0x274/0x2ec\n[ ]  ret_from_fork+0x10/0x20\n[ ] Code: 14000004 91004021 eb14003f 54000180 (f9400024)\n[ ] ---[ end trace 0000000000000000 ]---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/bluetooth/hci_core.h","net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"86f3dcd1f331cfd4fd7ec88906955134ec51afbe","lessThan":"f02c01ccd12cb2b8a290077d4c90f29a6e109b16","versionType":"git","status":"affected"},{"version":"7ce9bb0b95fc280e9212b8922590c492ca1d9c39","lessThan":"bbd262d2d750b67b15a5e1008d3848309c87e7a7","versionType":"git","status":"affected"},{"version":"16852eccbdfaf41a666705e3f8be55cf2864c5ca","lessThan":"18fda026a13c5abd6c1e0dfd3549f490b73378fb","versionType":"git","status":"affected"},{"version":"2935e556850e9c94d7a00adf14d3cd7fe406ac03","lessThan":"c3f63610bceaa182e4683b23cc47baf36b5f1496","versionType":"git","status":"affected"},{"version":"2935e556850e9c94d7a00adf14d3cd7fe406ac03","lessThan":"ee2135a14fb2a3e176149122764d293f0796b1eb","versionType":"git","status":"affected"},{"version":"2935e556850e9c94d7a00adf14d3cd7fe406ac03","lessThan":"59eecbe2f2f38d8f3e1104bd11da97f9a2c58998","versionType":"git","status":"affected"},{"version":"a351ff6b8ecca4229afaa0d98042bead8de64799","versionType":"git","status":"affected"},{"version":"f8069f34c4c976786ded97498012225af87435d7","versionType":"git","status":"affected"},{"version":"6.1.159","lessThan":"6.1.188","versionType":"semver","status":"affected"},{"version":"6.6.117","lessThan":"6.6.157","versionType":"semver","status":"affected"},{"version":"6.12.42","lessThan":"6.12.110","versionType":"semver","status":"affected"},{"version":"6.15.10","lessThan":"6.16","versionType":"semver","status":"affected"},{"version":"6.16.1","lessThan":"6.17","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/bluetooth/hci_core.h","net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/18fda026a13c5abd6c1e0dfd3549f490b73378fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59eecbe2f2f38d8f3e1104bd11da97f9a2c58998","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bbd262d2d750b67b15a5e1008d3848309c87e7a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3f63610bceaa182e4683b23cc47baf36b5f1496","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee2135a14fb2a3e176149122764d293f0796b1eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f02c01ccd12cb2b8a290077d4c90f29a6e109b16","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93248","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:20.963","lastModified":"2026-10-19T10:17:16.030","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: don't WARN on kernel job timeout when device already wedged\n\nigt@xe_wedged@wedged-at-any-timeout wedges the device in mode 2\n(UPON_ANY_HANG_NO_RESET) and then rebinds the driver. During unbind,\na GSC proxy kernel submission can still time out; with the device wedged\nand the GuC CT stopped it can never complete, so its kernel job times out.\n\n  Tile0: GT1: Kernel-submitted job timed out\n  WARNING: drivers/gpu/drm/xe/xe_guc_submit.c:...\n\t   at guc_exec_queue_timedout_job()\n  Workqueue: gt-ordered-wq drm_sched_job_timedout\n\nKilled queues skip guc_submit_hint_wedged(), leaving 'wedged' false even\nthough the device is already wedged. The timeout handler then treats the\nkernel queue timeout as unexpected and taints the kernel.\n\nHonour an already-wedged device even for killed queues so the expected\nteardown timeout no longer trips the WARN.\n\n(cherry picked from commit a1c1dbd0f047bb05de6aaf6abe9103031179bf19)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/xe/xe_guc_submit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5a2f117a80c207372513ca8964eeb178874f4990","lessThan":"041cce629a08d4a2f1a28ec61a105b26b7f047e6","versionType":"git","status":"affected"},{"version":"5a2f117a80c207372513ca8964eeb178874f4990","lessThan":"24d81b72992006f9c390f1fc85c7f991e6d06fd6","versionType":"git","status":"affected"},{"version":"5a2f117a80c207372513ca8964eeb178874f4990","lessThan":"13087ad7817e6e5f210064518bfc4d6d58a9c2f3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/xe/xe_guc_submit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/041cce629a08d4a2f1a28ec61a105b26b7f047e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/13087ad7817e6e5f210064518bfc4d6d58a9c2f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/24d81b72992006f9c390f1fc85c7f991e6d06fd6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93249","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:21.070","lastModified":"2026-10-19T10:17:16.123","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: amlogic-spisg: Make sure clk_init_data is fully initialized\n\nThe clk_init_data structure contains several mutually-exclusive members\nfor different methods to specify the possible parents of a clock,\nprompting drivers to initialize only the members they need.  However,\nnot initializing all members may cause subtle issues, which are only\nexposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is\nenabled.\n\naml_spisg_clk_init() fills in init.parent_data, and assumes that\ninit.parent_names is NULL.  However, the latter in uninitialized, and\nthus may cause a crash.\n\nMake sure all members are fully initialized, to fix such bugs, and to\navoid future breakage when converting drivers to a different method for\nspecifying the parents."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/spi/spi-amlogic-spisg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cef9991e04aed3305c61c392e880f6e01a0c2ea4","lessThan":"bfce0f324efaa605e606cbb3f0bdb8fe5c910c11","versionType":"git","status":"affected"},{"version":"cef9991e04aed3305c61c392e880f6e01a0c2ea4","lessThan":"5969a3df8361a0e20379a308c2313d3e263123de","versionType":"git","status":"affected"},{"version":"cef9991e04aed3305c61c392e880f6e01a0c2ea4","lessThan":"b2702908ee23ef31bfcf241a2e07ace0eb76bd71","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/spi/spi-amlogic-spisg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5969a3df8361a0e20379a308c2313d3e263123de","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2702908ee23ef31bfcf241a2e07ace0eb76bd71","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfce0f324efaa605e606cbb3f0bdb8fe5c910c11","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93250","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:21.187","lastModified":"2026-10-19T10:17:16.213","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: mdb: Fix use-after-free in vxlan_mdb_flush()\n\nvxlan_mdb_flush() iterates over the MDB entries using\nhlist_for_each_entry_safe(), which only tolerates the removal of the\ncurrent entry. Contrary to the comment above the loop, the removal of an\nentry can trigger the removal of another entry.\n\nFlushing the remotes of a (*, G) entry also removes the (S, G) entries\nthat were created for its source list, once they are left without\nremotes:\n\nvxlan_mdb_remotes_flush()\n-> vxlan_mdb_remote_del()\n   -> vxlan_mdb_remote_srcs_del()\n      -> vxlan_mdb_remote_src_del()\n         -> vxlan_mdb_remote_src_fwd_del()\n            -> __vxlan_mdb_del()\n               -> vxlan_mdb_entry_put()\n\nSuch an entry can be located after the (*, G) entry in the list, as\nvxlan_mdb_entry_get() returns an existing entry without moving it to the\nhead of the list. This order is obtained by adding the (S, G) entry\nbefore the (*, G) entry, the latter with NLM_F_REPLACE, as the addition\nof the source otherwise fails with -EEXIST. The (S, G) entry is then the\nentry saved by hlist_for_each_entry_safe() and it is freed while the\n(*, G) entry is processed. The next iteration calls hlist_del() on it\nagain, writing LIST_POISON1 to LIST_POISON2 [1].\n\nBesides device deletion, the flush is also reachable from RTM_DELMDB\nwith NLM_F_BULK.\n\nFix by re-reading the next entry after the remotes were flushed. The\ncurrent entry cannot be removed by this flush, as source lists can only\nbe configured on (*, G) entries and the removed entries are (S, G)\nentries. It is therefore still linked and its next pointer reflects the\nremovals.\n\n[1]\nBUG: KASAN: wild-memory-access in vxlan_mdb_entry_put.part.0+0x328/0x588\nWrite of size 8 at addr dead000000000122 by task ip/327\n\nCPU: 3 UID: 1000 PID: 327 Comm: ip Not tainted 7.2.0-rc7 #2 PREEMPT\nCall trace:\n vxlan_mdb_entry_put.part.0+0x328/0x588\n vxlan_mdb_flush+0x1d8/0x25c\n vxlan_mdb_fini+0x8c/0x100\n vxlan_uninit+0x1c/0x7c\n unregister_netdevice_many_notify+0x954/0xd4c\n rtnl_dellink+0x210/0x530\n rtnetlink_rcv_msg+0x434/0x4d0\n netlink_rcv_skb+0xc4/0x204\n rtnetlink_rcv+0x18/0x24\n netlink_unicast+0x4b8/0x548\n netlink_sendmsg+0x29c/0x560\n ____sys_sendmsg+0x390/0x3ec\n ___sys_sendmsg+0x114/0x188\n __sys_sendmsg+0xf0/0x178\n __arm64_sys_sendmsg+0x48/0x60\n invoke_syscall.constprop.0+0x58/0x180\n el0_svc_common.constprop.0+0x74/0x140\n do_el0_svc+0x30/0x40\n el0_svc+0x38/0x98\n el0t_64_sync_handler+0xa0/0xe4\n el0t_64_sync+0x198/0x19c"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/vxlan/vxlan_mdb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a3a48de5eade770e911d35291217bdd69ce04ef1","lessThan":"f8a9b988e7a7bc674e74e8c901794d792c35689e","versionType":"git","status":"affected"},{"version":"a3a48de5eade770e911d35291217bdd69ce04ef1","lessThan":"c7dc26d06f90ca11bbd6114f6a62a67d038816c7","versionType":"git","status":"affected"},{"version":"a3a48de5eade770e911d35291217bdd69ce04ef1","lessThan":"3e6b705bc162fc7257645725a7d2cf6c71250318","versionType":"git","status":"affected"},{"version":"a3a48de5eade770e911d35291217bdd69ce04ef1","lessThan":"f26400b325bdc2868e40612c4804c82cf8ba6275","versionType":"git","status":"affected"},{"version":"a3a48de5eade770e911d35291217bdd69ce04ef1","lessThan":"bc2dc66a6693a78f8c1e6ca2dbebd50f16e2c366","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/vxlan/vxlan_mdb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3e6b705bc162fc7257645725a7d2cf6c71250318","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc2dc66a6693a78f8c1e6ca2dbebd50f16e2c366","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c7dc26d06f90ca11bbd6114f6a62a67d038816c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f26400b325bdc2868e40612c4804c82cf8ba6275","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8a9b988e7a7bc674e74e8c901794d792c35689e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93251","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:21.340","lastModified":"2026-10-21T13:21:06.840","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: bus: Introduce acpi_bus_get_primary_device()\n\nThe function used for obtaining the first \"physical\" device for which\nthe given ACPI one is the ACPI companion, acpi_get_first_physical_node(),\nmay return a stale device pointer (mostly in theory) because\nacpi_unbind_one() may run as a whole after dropping the ACPI device's\nphysical_node_lock in acpi_get_first_physical_node() and before it\nreturns.  The last reference to the \"physical\" device may be dropped\nthen before the pointer to it is returned to the caller.\n\nIf that happens and the acpi_get_first_physical_node() caller invokes\nget_device() on the pointer obtained from it, which is done by the\nmajority of its callers, a use-after-free will occur.\n\nTo prepare for addressing this problem, introduce a new function for\ngetting the first \"physical\" device associated with the given ACPI one\n(the \"primary physical device\") that will also reference count the\ndevice in question before returning a pointer to it.\n\nMake that new function and acpi_get_first_physical_node() share the\nphysical node list lookup code.\n\nNo intentional functional impact."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/bus.c","include/acpi/acpi_bus.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"91e5687805885f9fceb60b95e950a3d3bdcf4764","lessThan":"50ddd82b88b1d1cc467b5df953344c1a9feec268","versionType":"git","status":"affected"},{"version":"91e5687805885f9fceb60b95e950a3d3bdcf4764","lessThan":"fd4f907b558721716da30acd6630191acf811b95","versionType":"git","status":"affected"},{"version":"91e5687805885f9fceb60b95e950a3d3bdcf4764","lessThan":"ebdd932dc24c1cf7cc31710b7730515e4e66d886","versionType":"git","status":"affected"},{"version":"91e5687805885f9fceb60b95e950a3d3bdcf4764","lessThan":"5657859851abb65105220a6cdb5804926249f714","versionType":"git","status":"affected"},{"version":"91e5687805885f9fceb60b95e950a3d3bdcf4764","lessThan":"72530e1f72b0515a73fd88292254d04fecf03649","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/bus.c","include/acpi/acpi_bus.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.8","status":"affected"},{"version":"0","lessThan":"3.8","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/50ddd82b88b1d1cc467b5df953344c1a9feec268","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5657859851abb65105220a6cdb5804926249f714","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72530e1f72b0515a73fd88292254d04fecf03649","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ebdd932dc24c1cf7cc31710b7730515e4e66d886","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd4f907b558721716da30acd6630191acf811b95","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93252","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:21.463","lastModified":"2026-10-19T10:17:16.453","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix circular locking dependency in ocfs2_init_acl()\n\nA lockdep warning indicates a circular locking dependency between\n`&oi->ip_xattr_sem` and `&journal->j_trans_barrier`:\n\nWARNING: possible circular locking dependency detected\nis trying to acquire lock:\n (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x2fd/0x7e0\n fs/ocfs2/acl.c:367\n\nbut task is already holding lock:\n (&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ab/0x700\n fs/ocfs2/journal.c:369\n\nThe deadlock involves two code paths: Path 1 (setxattr) where\n`ocfs2_xattr_set()` acquires `ip_xattr_sem` (write) and then starts a\ntransaction, which acquires `j_trans_barrier` (read); and Path 2\n(mkdir/mknod) where `ocfs2_mknod()` starts a transaction (`j_trans_barrier`\nread) and then calls `ocfs2_init_acl()`, which attempts to acquire\n`ip_xattr_sem` (read) on the parent directory to retrieve the default ACL.\n\nBecause rw_semaphores are subject to writer priority, a pending writer on\n`j_trans_barrier` (e.g., the journal commit thread) can cause Path 1 to\nblock, while Path 2 is blocked waiting for Path 1 to release\n`ip_xattr_sem`.\n\nThe patch fixes the lock ordering by precomputing the ACL state before\nstarting the OCFS2 transaction, while preserving POSIX ACL storage\nsemantics and the existing inode/security initialization order. By reading\nthe parent directory's default ACL and preparing the new inode's ACLs\noutside the transaction, `ip_xattr_sem` is always acquired before\n`j_trans_barrier`.\n\n`struct ocfs2_acl_state` encapsulates the prepared ACL state, while\n`ocfs2_acl_init_prepare()` and `ocfs2_acl_init_release()` avoid code\nduplication between `ocfs2_mknod()` and `ocfs2_init_security_and_acl()`.\n`ocfs2_calc_xattr_init()` and `ocfs2_init_acl()` use this precomputed\nstate, removing internal `ip_xattr_sem` acquisition and redundant disk\nreads.\n\nAdditionally, remove the `ip_xattr_sem` acquisition from\n`ocfs2_xattr_set_handle()`. This function is only used while initializing a\nnew inode that has not yet been inserted into the inode hash or attached to\na dentry, meaning there is no risk of concurrent access and the lock is\nunnecessary."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ocfs2/acl.c","fs/ocfs2/acl.h","fs/ocfs2/namei.c","fs/ocfs2/xattr.c","fs/ocfs2/xattr.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"4936d4464d1ae10b5fbba64374085a0dcc060560","versionType":"git","status":"affected"},{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"caf3056936fb8b5ce92e419cf8b246ce9c437343","versionType":"git","status":"affected"},{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"5b7b3c50c39ad0dc27e7418981e01c4183273f89","versionType":"git","status":"affected"},{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"8d88f52fbbbcc18adf4091a955511d0cf605bf11","versionType":"git","status":"affected"},{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"8931403ee3dcfe8a24a5267efec9d9460ab7a1b5","versionType":"git","status":"affected"},{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"f8747d81aa6d3efe3ee339a9d912ff3ca6e4d758","versionType":"git","status":"affected"},{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"1222f7a3183b35c0c566899fdaead5c7c4043076","versionType":"git","status":"affected"},{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"bd7c05fb4a4776dff5a87b19008d28458647d15d","versionType":"git","status":"affected"},{"version":"15ac59a84750b3afc0a2b6f2636c4f7e6cbd6d5e","versionType":"git","status":"affected"},{"version":"b35bb8a41795caa05e09c3aacf7d78f1f20bac04","versionType":"git","status":"affected"},{"version":"1d5fdc1307eeb04b334c5dc23e11dbd6068d90eb","versionType":"git","status":"affected"},{"version":"a66174eb4a149b7919d174d9a7ce6ad9909c5ee2","versionType":"git","status":"affected"},{"version":"3.18.111","lessThan":"3.19","versionType":"semver","status":"affected"},{"version":"4.4.134","lessThan":"4.5","versionType":"semver","status":"affected"},{"version":"4.9.104","lessThan":"4.10","versionType":"semver","status":"affected"},{"version":"4.14.37","lessThan":"4.15","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ocfs2/acl.c","fs/ocfs2/acl.h","fs/ocfs2/namei.c","fs/ocfs2/xattr.c","fs/ocfs2/xattr.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1222f7a3183b35c0c566899fdaead5c7c4043076","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4936d4464d1ae10b5fbba64374085a0dcc060560","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5b7b3c50c39ad0dc27e7418981e01c4183273f89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8931403ee3dcfe8a24a5267efec9d9460ab7a1b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8d88f52fbbbcc18adf4091a955511d0cf605bf11","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd7c05fb4a4776dff5a87b19008d28458647d15d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/caf3056936fb8b5ce92e419cf8b246ce9c437343","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8747d81aa6d3efe3ee339a9d912ff3ca6e4d758","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93253","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:21.640","lastModified":"2026-10-19T10:17:16.593","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched/isolation: Defer freeing of cpumask memblock memory to initcall\n\nWhen testing a linux-next kernel with commit 59bd1d914bb5 (\"memblock:\nwarn when freeing reserved memory before memory map is initialized\"),\nthe following warning was hit when there was a \"nohz_full\" kernel boot\nparameter.\n\n  Cannot free reserved memory because of deferred initialization of the memory map\n  WARNING: mm/memblock.c:904 at __free_reserved_area+0xde/0xf0, CPU#0: swapper/0/0\n    :\n  Call Trace:\n   <TASK>\n   memblock_phys_free+0xcb/0x100\n   housekeeping_init+0x14c/0x170\n   start_kernel+0x207/0x450\n   x86_64_start_reservations+0x24/0x30\n   x86_64_start_kernel+0xda/0xe0\n   common_startup_64+0x13e/0x141\n   </TASK>\n\nIOW, we shouldn't free memblock allocated memory so early\nin the boot process when memory map isn't fully initialized in\ndeferred_init_memmap().\n\nFix it by saving the housekeeping cpumask memblock memory to be\nfreed into a llist free list in housekeeping_init() and add a new\nhousekeeping_late_init() helper to defer the actual freeing of memblock\nmemory to when initcall's are being processed. The cpumask memblock\nmemory is treated as a llist_node with the size of a \"long\" type which\nis also smallest cpumask size that can be allocated.\n\nThe non-atomic version of the llist APIs are used as there is no\ncontention.\n\nThis commit depends on the presence of commit 7c2eee9c1367 (\"memblock:\ndon't touch memblock arrays when memblock_free() is called late\")\nto prevent a KASAN UAF bug report [1].\n\n [1] https://lore.kernel.org/lkml/20260505051821.1107133-1-longman@redhat.com/"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/sched/isolation.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"27c3a5967f054ab666704cb28f2aeb18ca07cab7","lessThan":"811fdac2d1bdf0b0d3fda262aac288ddd13a1422","versionType":"git","status":"affected"},{"version":"27c3a5967f054ab666704cb28f2aeb18ca07cab7","lessThan":"2b58c749b8c5244e259a0230bc57b10b010dc545","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/sched/isolation.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2b58c749b8c5244e259a0230bc57b10b010dc545","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/811fdac2d1bdf0b0d3fda262aac288ddd13a1422","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93254","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:21.807","lastModified":"2026-10-19T10:17:16.687","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: entry: Avoid unnecessary local_irq_disable() on kernel exit\n\nCurrently, when exiting to kernel mode, we attempt involuntary\npreemption. The preemption logic expects IRQs to be disabled, which is\nwhy we call local_irq_disable() before attempting preemption.\n\nHowever, depending on the context, local_irq_disable() may be\nunnecessary:\n\n- __el1_irq(), the non-NMI EL1 IRQ path, already has IRQs disabled, so\n  local_irq_disable() is redundant.\n\n- irqentry_exit_to_kernel_mode_preempt() immediately returns when\n  exiting from an NMI-like context, so calling local_irq_disable()\n  beforehand is unnecessary work.\n\nFurthermore, it confuses the pNMI state tracking when we are in a\ncontext with interrupts disabled and the GIC_PRIO_PSR_I_SET bit is set\nin the PMR, leading to a warning when\nCONFIG_ARM64_DEBUG_PRIORITY_MASKING=y:\n\n     WARNING: ./arch/arm64/include/asm/irqflags.h:63 at arm64_exit_to_kernel_mode+0xb8/0xc0, CPU#40: retsnoop/31805\n     CPU: 40 UID: 0 PID: 31805 Comm: retsnoop Not tainted 7.2.0-rc6-next-20260805 #7 PREEMPTLAZY\n     pstate: 234013c9 (nzCv DAIF +PAN -UAO +TCO +DIT +SSBS BTYPE=--)\n     pc : arm64_exit_to_kernel_mode (arch/arm64/kernel/entry-common.c:63)\n     lr : el1_abort (arch/arm64/kernel/entry-common.c:323)\n     pmr: 000000f0\n     Call trace:\n      arm64_exit_to_kernel_mode (arch/arm64/kernel/entry-common.c:63) (P)\n      el1_abort (arch/arm64/kernel/entry-common.c:323)\n      el1h_64_sync_handler (arch/arm64/kernel/entry-common.c:449)\n      el1h_64_sync (arch/arm64/kernel/entry.S:589)\n      [...]\n\nSplit arm64_exit_to_kernel_mode() into preempt, non-preempt, and\ndispatch parts so that we can avoid this extra work where it is not\nneeded and avoid breaking the pNMI tracking logic."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/kernel/entry-common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ae654112eac05f316ef31587fc55e4d7160d0086","lessThan":"49a61174186bed25d439ff37400c7ce5e3603e73","versionType":"git","status":"affected"},{"version":"ae654112eac05f316ef31587fc55e4d7160d0086","lessThan":"39aebe0e89469c2904e60b1e977e0d4dbf33326b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/kernel/entry-common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/39aebe0e89469c2904e60b1e977e0d4dbf33326b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/49a61174186bed25d439ff37400c7ce5e3603e73","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93255","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.007","lastModified":"2026-10-19T10:17:16.780","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock\n\n[FALSE ALERTS]\nThere is a bug report that the warning inside\ninvalidate_and_check_btree_folios() got triggered during btrfs/298:\n\n BTRFS info (device sdd): first mount of filesystem f9bf732a-a19b-44b9-99a7-614ddff168e2\n BTRFS info (device sdd): using crc32c checksum algorithm\n BTRFS error (device sdd): failed to find fsid cb2fdb42-b638-4f2f-badd-4127467ba674 when attempting to open seed devices\n BTRFS error (device sdd): failed to read chunk tree: -2\n ------------[ cut here ]------------\n WARNING: disk-io.c:3342 at invalidate_and_check_btree_folios+0x260/0x3c0 [btrfs], CPU#4: mount/125993\n CPU: 4 UID: 0 PID: 125993 Comm: mount Tainted: G        W  OE       7.1.0-rc7-custom+ #1 PREEMPT(full)\n Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025\n Call trace:\n  invalidate_and_check_btree_folios+0x260/0x3c0 [btrfs] (P)\n  open_ctree+0x1f50/0x23b0 [btrfs]\n  btrfs_get_tree+0x89c/0xc48 [btrfs]\n  vfs_get_tree+0x30/0x110\n  vfs_cmd_create+0x58/0xe8\n  __arm64_sys_fsconfig+0x39c/0x518\n  invoke_syscall.constprop.0+0x48/0x120\n  el0_svc_common.constprop.0+0x40/0xe8\n  do_el0_svc+0x24/0x38\n  el0_svc+0x50/0x310\n  el0t_64_sync_handler+0xa0/0xe8\n  el0t_64_sync+0x198/0x1a0\n ---[ end trace 0000000000000000 ]---\n BTRFS warning (device sdd): unable to release extent buffer 365985792 owner 3 gen 17 refs 3 flags 0x5\n\n[CAUSE]\nIn that invalidate_and_check_btree_folios() we wait for the eb to finish\nits read, then check if it's only held by us and the btree inode.\n\nIf not, then do a warning as it may be still held, and could cause\nproblems.\n\nBut there is a small window where the check can lead to false alerts:\n\n    Thread A (Read endio)         |        Thread B (Unmount)\n----------------------------------+-------------------------------------\n end_bbio_meta_read()             |\n | The eb has one extra ref held  |\n | by the reader, and has         |\n | EXTENT_BUFFER_READING flag set | invalidate_and_check_btree_folios()\n |                                | |\n |- clear_extent_buffer_reading() | |\n |                                | |- wait_on_bit_io();\n |                                | |  The EXTENT_BUFFER_READING flag is\n |                                | |  cleared\n |                                | |- if (refcount_read(eb->refs) > 2)\n |                                |    The eb is held by the read, us\n |                                |    and btree inode, thus it\n |                                |    will trigger the warning\n |- free_extent_buffer()          |\n\n[FIX]\nIntroduce a helper, free_extent_buffer_clear_reading().\n\nIf the new parameter, @clear_reading, is set, we will hold the spinlock\nat the beginning of free_extent_buffer_clear_reading() to make sure the\nEXTENT_BUFFER_READING flag is cleared inside the same critical section\nof decreasing refs.\n\nNow free_extent_buffer() will just call\nfree_extent_buffer_clear_reading() with @clear_reading set to false, so\nno behavior change.\n\nBut for end_bbio_meta_read(), it will not clear_extent_buffer_reading()\ndirectly, but pass @clear_reading as true.\n\nThen inside invalidate_and_check_btree_folios(), hold the refs_lock\nbefore reading refs.\nSo that we eliminate the race window completely."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/disk-io.c","fs/btrfs/extent_io.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f5427cab065641a4553d38bb8c4932b8d456c7a7","lessThan":"8f7285d608ed0db7c9f09f341547db5ce1351090","versionType":"git","status":"affected"},{"version":"83f7e52b7ed1c3e03b79123e20b6f6adf8d886bb","lessThan":"2073f3d97b0c5d34fe64812d1237e37bd79c17ec","versionType":"git","status":"affected"},{"version":"83f7e52b7ed1c3e03b79123e20b6f6adf8d886bb","lessThan":"690c2accacb1aca91ab8186d15dee56da8723f31","versionType":"git","status":"affected"},{"version":"b0c33c0628c5b0678fcae2e05e7b2764149248f8","versionType":"git","status":"affected"},{"version":"7.1.8","lessThan":"7.2","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/disk-io.c","fs/btrfs/extent_io.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2073f3d97b0c5d34fe64812d1237e37bd79c17ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/690c2accacb1aca91ab8186d15dee56da8723f31","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f7285d608ed0db7c9f09f341547db5ce1351090","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93256","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.157","lastModified":"2026-10-19T10:17:16.893","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: hibernate: mask DAIF before restoring hibernated kernel\n\nThe arm64 hibernate code manages the exception masking in an unsound\nway, leading to potential crashes and/or warnings during resume.\n\nWhen a hibernation image is saved in `swsusp_arch_suspend()`, all DAIF\nexceptions are masked (by virtue of `local_daif_save()`), and the\nsuspended image is saved assuming that all DAIF exceptions will remain\nmasked when the image is restored.\n\nWhen a hibernation image is resumed by `swsusp_arch_resume()`, only\ninterrupts are masked (by virtue of `local_irq_disable()` in\n`resume_target_kernel()`). When pseudo-NMI is enabled the DAIF.IF bits\nwill be clear, and regardless of pseudo-NMI the DAIF.DA bits will be\nclear.\n\nThis means that there are two problems:\n\n(1) It is possible to take Debug, SError, or pseudo-NMI exceptions\n    during the resume process. This is unsafe, as during the resume\n    process both the old ane new kernels will tranisently be in an\n    inconsistent state, and swsusp_arch_suspend_exit() won't retain\n    an executable mapping of any exception vectors.\n\n    Any exception taken here will be fatal and silent.\n\n(2) When re-entering the resumed kernel, some DAIF bits will be clear\n    unexpectedly. This permits Debug, SError, or pseudo-NMI exceptions\n    to be taken for a short period while the resumed kernel is not yet\n    in a consistent state.\n\n    This is detected by CONFIG_ARM64_DEBUG_PRIORITY_MASKING.\n\nAvoid these issues by masking all DAIF exceptions during resume."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/kernel/hibernate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"c9c671e9ab87b639720db8f7f8648bdf0f3bc8ec","versionType":"git","status":"affected"},{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"099ad3edcef1d955d9f5d6aab16ae78ecdfd4cda","versionType":"git","status":"affected"},{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"716c41bd476334afb943308be9ff2142e34461b7","versionType":"git","status":"affected"},{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"5370853041a3cb53a125b77528586278f64b378b","versionType":"git","status":"affected"},{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"290c5b0c9fc0c61fb1c41421ed2394f955206ea0","versionType":"git","status":"affected"},{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"012823494e20c3cce622982ebd3fd6971be39ad2","versionType":"git","status":"affected"},{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"d736ace2c491623c9ab5e73744085e93e9ae3ebe","versionType":"git","status":"affected"},{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"684bde100117931f4c51c644a95f42f2dab041bc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/kernel/hibernate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/012823494e20c3cce622982ebd3fd6971be39ad2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/099ad3edcef1d955d9f5d6aab16ae78ecdfd4cda","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/290c5b0c9fc0c61fb1c41421ed2394f955206ea0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5370853041a3cb53a125b77528586278f64b378b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/684bde100117931f4c51c644a95f42f2dab041bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/716c41bd476334afb943308be9ff2142e34461b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9c671e9ab87b639720db8f7f8648bdf0f3bc8ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d736ace2c491623c9ab5e73744085e93e9ae3ebe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93257","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.310","lastModified":"2026-10-19T10:17:17.020","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock: handle nogenerate/noverify properly in fs-integrity\n\nCheck the BIP_CHECK flags before generating or verifying PI information,\notherwise this can be incorrectly called for non-PI metadata and\ncause generation of incorrect metadata and crashed in the verification\nhandler.\n\nThe new behavior matches that of the block layer auto-generated\nmetadata."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["block/bio-integrity-fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0bde8a12b5540572a7fd6d2867bee6de15e4f289","lessThan":"b681c740e6d645f7d7477e9208db57917c6c0fbc","versionType":"git","status":"affected"},{"version":"0bde8a12b5540572a7fd6d2867bee6de15e4f289","lessThan":"3bf9a21e7bccfd8c35b440efd114c61cc9838a41","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["block/bio-integrity-fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3bf9a21e7bccfd8c35b440efd114c61cc9838a41","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b681c740e6d645f7d7477e9208db57917c6c0fbc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93258","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.420","lastModified":"2026-10-19T10:17:17.110","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full()\n\nThis reverts commit 58b6fcd2ab34 (\"ocfs2: mark inode bad upon validation\nfailure during read\").\n\nSince 'make_bad_inode()' resets inode type to S_IFREG, doing this for\ndirectory inode during active VFS lookup is likely to confuse the latter,\nincluding VFS_BUG_ON_INODE() triggered in this case."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ocfs2/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"58b6fcd2ab34399258dc509f701d0986a8e0bcaa","lessThan":"0e7459abff46e28e64367057038ef8607e63f599","versionType":"git","status":"affected"},{"version":"58b6fcd2ab34399258dc509f701d0986a8e0bcaa","lessThan":"d48ace65322001b41bb5322442a21425ef4407d4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ocfs2/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0e7459abff46e28e64367057038ef8607e63f599","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d48ace65322001b41bb5322442a21425ef4407d4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93259","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.530","lastModified":"2026-10-19T10:17:17.190","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/irq: Fix missing r2 clobber in PCREL inline assembly\n\nIn CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC\npointer and is available as a caller-saved register [0].\n\nBoth call_do_irq() and call_do_softirq() use inline assembly to call\nfunctions with stack switching, but fail to list r2 in their clobber\nlists. This causes the compiler to assume r2 is preserved across these\ncalls, leading to register corruption when the called functions\n(__do_irq and __do_softirq) clobber r2.\n\nAs a result of this kernel crash during interrupt handling is seen and\nthe kernel fails to boot:\n\nBUG: Unable to handle kernel data access on write at 0xc000000404697638\nFaulting instruction address: 0xc0000000000181ec\nOops: Kernel access of bad area, sig: 11 [#1]\nNIP [c0000000000181ec] __do_IRQ+0x6c/0xc0\n\nWith older GCC, the compiler would conservatively allocate\ncallee-saved registers (like r31) for values spanning function calls,\naccidentally avoiding the bug:\n\n<__do_IRQ>:\n00 00 00 60 \tnop\na6 02 08 7c \tmflr    r0\nf8 ff e1 fb \tstd     r31,-8(r1)\nf0 ff c1 fb \tstd     r30,-16(r1)\n2d 03 10 06 \tpla     r31,53297316\n\n...\n\n3d e8 ff 4b \tbl      c0000000000165ac <__do_irq>\n00 00 21 e8 \tld      r1,0(r1)\n28 00 4d e9 \tld      r10,40(r13)\n40 00 21 38 \taddi    r1,r1,64\n2a f9 aa 7f \tstdx    r29,r10,r31\n\nWith newer GCC 14, the compiler uses r2 for such values, exposing the\nmissing clobber specification:\n\n<__do_IRQ>:\n00 00 00 60     nop\na6 02 08 7c     mflr    r0\nf0 ff c1 fb     std     r30,-16(r1)\nf8 ff e1 fb     std     r31,-8(r1)\n29 02 10 06     pla     r2,36252592     # c0000000022aadc0 <__irq_regs>\n\n...\n\n85 dc ff 4b \tbl      c000000000015ee0 <__do_irq>\n00 00 21 e8 \tld      r1,0(r1)\n28 00 2d e9 \tld      r9,40(r13)\n30 00 21 38 \taddi    r1,r1,48\n2a 11 c9 7f \tstdx    r30,r9,r2\n\nFix this by adding r2 to the clobber list for both call_do_irq() and\ncall_do_softirq() when CONFIG_PPC_KERNEL_PCREL is enabled.\n\n[0]: https://www.mail-archive.com/gcc-patches@gcc.gnu.org/msg313226.html"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/powerpc/kernel/irq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7e3a68be42e10f5fa5890e97afc0afd992355bc3","lessThan":"dcc442a49c0f540193910dacdca7506bcadc7ec5","versionType":"git","status":"affected"},{"version":"7e3a68be42e10f5fa5890e97afc0afd992355bc3","lessThan":"602ee44415f3eaa7893f7fc488c7c1d4a0bdbd7a","versionType":"git","status":"affected"},{"version":"7e3a68be42e10f5fa5890e97afc0afd992355bc3","lessThan":"90d953002cf0b233dd053a0e7cb67ab79cebd0e3","versionType":"git","status":"affected"},{"version":"7e3a68be42e10f5fa5890e97afc0afd992355bc3","lessThan":"7b0093b638c8f2b94b0778a69fd1ccad54299b29","versionType":"git","status":"affected"},{"version":"7e3a68be42e10f5fa5890e97afc0afd992355bc3","lessThan":"00be69070d91d2be978e752bb117a0a4db0e1281","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/powerpc/kernel/irq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/00be69070d91d2be978e752bb117a0a4db0e1281","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/602ee44415f3eaa7893f7fc488c7c1d4a0bdbd7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7b0093b638c8f2b94b0778a69fd1ccad54299b29","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/90d953002cf0b233dd053a0e7cb67ab79cebd0e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dcc442a49c0f540193910dacdca7506bcadc7ec5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93260","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.670","lastModified":"2026-10-21T13:21:07.093","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/xive: propagate IPI init errors to prevent use-after-free\n\nWhen xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails),\nthe error path frees the global xive_ipis array.  However,\nxive_smp_probe() previously ignored this failure and proceeded to\ncall xive_setup_cpu_ipi(), which dereferences the already-freed\nxive_ipis pointer -- a use-after-free.\n\nNow that xive_smp_probe() returns int (previous patch), propagate\nthe error from xive_init_ipis() and xive_setup_cpu_ipi() through\nxive_smp_probe().  Check the return value in both pnv_smp_probe()\nand pSeries_smp_probe() so that IPI setup is aborted cleanly on\nfailure, avoiding the use-after-free."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/powerpc/platforms/powernv/smp.c","arch/powerpc/platforms/pseries/smp.c","arch/powerpc/sysdev/xive/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"e36b1c2eafcaaddefa70d55e6fda74cf6cda38af","versionType":"git","status":"affected"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"2ea6238343691309e68308131c7e80c3ae05afea","versionType":"git","status":"affected"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"5c9ab0c9cede9f149733d330e2d7d45341b71359","versionType":"git","status":"affected"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"c554a8d376d5aea1b237ed6bef6f9fbfc550e67f","versionType":"git","status":"affected"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"411a3c016e7a95f5fa105a0587e07d0647a77727","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/powerpc/platforms/powernv/smp.c","arch/powerpc/platforms/pseries/smp.c","arch/powerpc/sysdev/xive/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.4,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2ea6238343691309e68308131c7e80c3ae05afea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/411a3c016e7a95f5fa105a0587e07d0647a77727","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c9ab0c9cede9f149733d330e2d7d45341b71359","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c554a8d376d5aea1b237ed6bef6f9fbfc550e67f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e36b1c2eafcaaddefa70d55e6fda74cf6cda38af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93261","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.780","lastModified":"2026-10-19T10:17:17.410","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/lockdep: Fix NULL pointer dereference in __lock_set_class()\n\nregister_lock_class() can return NULL when the lock class pool is\nexhausted, graph_lock() fails, or key validation fails. However,\n__lock_set_class() uses the return value directly in pointer arithmetic\nwithout a NULL check:\n\n  class = register_lock_class(lock, subclass, 0);\n  hlock->class_idx = class - lock_classes;\n\nIf class is NULL, this computes a wild offset that corrupts\nhlock->class_idx. The subsequent reacquire_held_locks() call will\ninvoke hlock_class() with this corrupted index, leading to a NULL or\nout-of-bounds pointer dereference.\n\nAdd the missing NULL check, consistent with how __lock_acquire() already\nhandles this case at the same call site."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/locking/lockdep.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"f6093ff67ea6e347574819ed23e96e0f82a25ffc","versionType":"git","status":"affected"},{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"59a5c7dd331a3dab48100e1ef8e9bb4f9132a2b2","versionType":"git","status":"affected"},{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"f56e54fd24f05e9de528fcb77f6084f80c8066ce","versionType":"git","status":"affected"},{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"5c3bff6cf26e6a54fbf8b893a879c32824d2d50d","versionType":"git","status":"affected"},{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"b2113dcd8238bf00ce37a34e67b29cf31d32a545","versionType":"git","status":"affected"},{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"e7c69c6695d84220847cca62a45e879e71e79e9d","versionType":"git","status":"affected"},{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"9be10f49dfc2e4b472b3a5f346483b67374774b8","versionType":"git","status":"affected"},{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"7577e00b9ab506202b9f1a33de3cc8cc6413a4db","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/locking/lockdep.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.27","status":"affected"},{"version":"0","lessThan":"2.6.27","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/59a5c7dd331a3dab48100e1ef8e9bb4f9132a2b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c3bff6cf26e6a54fbf8b893a879c32824d2d50d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7577e00b9ab506202b9f1a33de3cc8cc6413a4db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9be10f49dfc2e4b472b3a5f346483b67374774b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2113dcd8238bf00ce37a34e67b29cf31d32a545","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7c69c6695d84220847cca62a45e879e71e79e9d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f56e54fd24f05e9de528fcb77f6084f80c8066ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f6093ff67ea6e347574819ed23e96e0f82a25ffc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93262","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.927","lastModified":"2026-10-19T10:17:17.523","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5-ppl: fix use-after-free in ppl_do_flush()\n\nThe loop in ppl_do_flush() continues iterating after calling\nppl_io_unit_finished(), touching io->pending_flushes and leading to a\nuse-after-free.\n\nAdd a break statement to stop the loop once io is freed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/md/raid5-ppl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"cf01f9413565e86673baf927291a088b6975692b","versionType":"git","status":"affected"},{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"e7505842f1329ece90cb9ea0db87772aeca44052","versionType":"git","status":"affected"},{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"b5123bf667ac29ddd8106f9ca7cc01316513ae66","versionType":"git","status":"affected"},{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"e77c80670f2c2bf491da9b173931e1da4677c23a","versionType":"git","status":"affected"},{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"8914c3d40870f16429a326e97e4016bedc6ede4c","versionType":"git","status":"affected"},{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"455b56209f9615c3902dcc398dd867abb5ade3ab","versionType":"git","status":"affected"},{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"fcf21df7d3c50c8ebeb0757df5d21b02dcae4218","versionType":"git","status":"affected"},{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"371f7a1b392edc8b7cf449cc7713179b588f2d0e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/md/raid5-ppl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/371f7a1b392edc8b7cf449cc7713179b588f2d0e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/455b56209f9615c3902dcc398dd867abb5ade3ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8914c3d40870f16429a326e97e4016bedc6ede4c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5123bf667ac29ddd8106f9ca7cc01316513ae66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf01f9413565e86673baf927291a088b6975692b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7505842f1329ece90cb9ea0db87772aeca44052","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e77c80670f2c2bf491da9b173931e1da4677c23a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fcf21df7d3c50c8ebeb0757df5d21b02dcae4218","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93263","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:23.067","lastModified":"2026-10-19T10:17:17.657","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nclk: eswin: Zero-initialize stack-allocated clk_init_data\n\neswin_clk_register_pll() and eswin_register_clkdiv() declare a struct\nclk_init_data on the stack and only initialize some of its fields\n(parent_data respectively parent_hws). clk_core_populate_parent_map()\nchecks parent_names first and parent_data second before falling back\nto parent_hws, so leftover stack garbage in the uninitialized fields\nhijacks parent resolution and the clk core dereferences a bogus\npointer:\n\n  Unable to handle kernel NULL pointer dereference at virtual address 000000000000000c\n  Oops [#1]\n  epc : __clk_register+0x31a/0x7f0\n  [<ffffffff805dc774>] __clk_register+0x31a/0x7f0\n  [<ffffffff805dcd76>] devm_clk_hw_register+0x2a/0x94\n  [<ffffffff805e319a>] eswin_register_clkdiv+0x80/0xd0\n  [<ffffffff805e34a0>] eswin_clk_register_clks+0x162/0x1a0\n  [<ffffffff805e3736>] eic7700_clk_probe+0x146/0x180\n  [<ffffffff8065d23c>] platform_probe+0x3c/0x7a\n\nObserved on EIC7700 hardware (with the driver backported to a 6.17\ntree); whether the bug triggers depends entirely on what the stack\nhappens to contain when the registration helpers run.\n\nZero-initialize both structures."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/clk/eswin/clk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cd44f127c1d42833a32ba0a0965255ee6184f8c1","lessThan":"1183dc2450a268a536a15da8b106ec520cdbd19f","versionType":"git","status":"affected"},{"version":"cd44f127c1d42833a32ba0a0965255ee6184f8c1","lessThan":"011d8de504bc84402aabc1dda1cf0552fe9a5af2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/clk/eswin/clk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/011d8de504bc84402aabc1dda1cf0552fe9a5af2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1183dc2450a268a536a15da8b106ec520cdbd19f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93264","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:23.193","lastModified":"2026-10-19T10:17:17.760","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Fix PBL chunk length computation\n\nOn register MR, when creating the PBL, if it's an indirect PBL we create\na chunk list to hold the PBL pages pointers. Each chunk is 4KB in size\nand can hold 510 addresses (EFA_PTRS_PER_CHUNK) and has a 12-byte\ncontrol buffer at the end of it holding the next chunk's pointer and its\nlength.\n\nIf the PBL number of pages is a multiple of EFA_PTRS_PER_CHUNK, the\ncalculated last chunk length is wrongly computed as 0, even though that\nchunk is fully populated with 510 real page pointers. This wrong length\nis used both to DMA map the chunk and is propagated to the device,\ncausing the device to see the chunk as empty and reject the memory\nregistration.\n\nFix the calculation so it will be performed only if the number of pages\nisn't a multiple of EFA_PTRS_PER_CHUNK, if it is, its already handled in\nthe above loop correctly.\nAlso prevent out-of-bounds reach in the chunks array in such scenario."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/hw/efa/efa_verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"665cd418b8561a099c3854443f8ad8ae751b72a0","versionType":"git","status":"affected"},{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"932e5684906a090644a9061fae2d254041c3b8f2","versionType":"git","status":"affected"},{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"489b28f2377afa70c18c45b06a6387f3d39bb123","versionType":"git","status":"affected"},{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"aadf3f9b5edb7f0a77e9172b237d2e07c754829c","versionType":"git","status":"affected"},{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"3982714e15512b83115897806dacc94899683420","versionType":"git","status":"affected"},{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"da7805f0211af19968584e621074f253ac07dba7","versionType":"git","status":"affected"},{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"1d4b5902773475fc97151379b7e5f09cad0fa57b","versionType":"git","status":"affected"},{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"229b42d7450c1cf96f45ec39ebb69211b06bc036","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/hw/efa/efa_verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.2","status":"affected"},{"version":"0","lessThan":"5.2","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1d4b5902773475fc97151379b7e5f09cad0fa57b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/229b42d7450c1cf96f45ec39ebb69211b06bc036","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3982714e15512b83115897806dacc94899683420","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/489b28f2377afa70c18c45b06a6387f3d39bb123","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/665cd418b8561a099c3854443f8ad8ae751b72a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/932e5684906a090644a9061fae2d254041c3b8f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aadf3f9b5edb7f0a77e9172b237d2e07c754829c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da7805f0211af19968584e621074f253ac07dba7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93265","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:23.340","lastModified":"2026-10-19T10:17:17.897","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node\n\nDSP3 has an integrated Ethernet MAC Endpoint which has its own set of\nconfig registers for configuring settings such as ASPM. The Endpoint device\nhas two physical functions and those two functions share the same settings.\n\nParse the Endpoint node under DSP3 instead of parsing both functions.  The\nexisting parsing logic also has one OOB issue as parsing both functions\nwill result in accessing past the tc9563_pwrctrl->cfg array."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/pwrctrl/pci-pwrctrl-tc9563.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4c9c7be47310c1dbd7b6d37d45986123f5b133b4","lessThan":"972c771674e88a43c8310c459ea30f0f0d0c168f","versionType":"git","status":"affected"},{"version":"4c9c7be47310c1dbd7b6d37d45986123f5b133b4","lessThan":"6e5e6c2194b2acbded5b12ed80590d215b786d29","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/pwrctrl/pci-pwrctrl-tc9563.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/6e5e6c2194b2acbded5b12ed80590d215b786d29","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/972c771674e88a43c8310c459ea30f0f0d0c168f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93266","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:23.453","lastModified":"2026-10-19T10:17:18.003","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: RSI: fix field-spanning write warning in attestation token init\n\nThe challenge is passed in registers a1 through a8. However, copying to\n&regs.a1 makes FORTIFY treat the destination as the single a1 field,\nresulting in a field-spanning write warning. [1]\n\nOverlay the SMCCC register structure with an RSI-specific argument\nlayout and copy the challenge into an explicit 64-byte array. This keeps\nthe existing a1-a8 argument encoding while giving the copy a correctly\nsized destination object.\n\n[1]\nmemcpy: detected field-spanning write (size 64) of single field \"&regs.a1\" at ./arch/arm64/include/asm/rsi_cmds.h:119 (size 8)\nWARNING: ./arch/arm64/include/asm/rsi_cmds.h:119 at rsi_attestation_token_init+0xdc/0xf8 [arm_cca_guest], CPU#0: cat/3314"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/include/asm/rsi_cmds.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b880a80011f56880f32bde47fc6af313359f926b","lessThan":"e505092cb200d430d5b8d8d3e926d45f29474ba3","versionType":"git","status":"affected"},{"version":"b880a80011f56880f32bde47fc6af313359f926b","lessThan":"d29a8ee271da17b5e32d7a76a9c78d43f66447ca","versionType":"git","status":"affected"},{"version":"b880a80011f56880f32bde47fc6af313359f926b","lessThan":"221049874b6a78c7d87bc826581b0695cd338e2b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/include/asm/rsi_cmds.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/221049874b6a78c7d87bc826581b0695cd338e2b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d29a8ee271da17b5e32d7a76a9c78d43f66447ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e505092cb200d430d5b8d8d3e926d45f29474ba3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93267","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:23.570","lastModified":"2026-10-19T10:17:18.093","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Fix potential use after free in uverbs_free_dmah()\n\nWhen accessing a dmah via the netlink path the only synchronization\nmechanism for the said dmah is rdma_restrack_get().\nCurrently, rdma_restrack_del() is invoked at the end of\nuverbs_free_dmah(), which is too late, since by that point\nvendor-specific resources associated with the dmah might already be\nfreed. This can leave a short window where the dmah remains accessible\nthrough restrack, leading to a potential use-after-free.\n\nFix this by moving the rdma_restrack_begin_del() call to the start of\nuverbs_free_dmah(), ensuring that the dmah is removed from restrack\nbefore its internal resources are released. This guarantees that no new\nusers hold references to a dmah that is in the process of destruction.\n\nIn addition, this change preserves the intended inverted order\nbetween create and destroy routines: resources are added to\nrestrack at the end of successful creation, and hence shall be removed\nfrom the restrack first thing during the destruction flow, which keeps\nthe lifecycle management consistent and predictable."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/core/uverbs_std_types_dmah.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d83edab562a496a42720902a1d2effccd05c37c5","lessThan":"8b22722f45a29a7c0900b1d4d0bc5da5492ece10","versionType":"git","status":"affected"},{"version":"d83edab562a496a42720902a1d2effccd05c37c5","lessThan":"bfc119a40c04bbe3daad826f2160ccbfae6c64ce","versionType":"git","status":"affected"},{"version":"d83edab562a496a42720902a1d2effccd05c37c5","lessThan":"2696626a0be5877f445fb647c25ef43930c777e6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/core/uverbs_std_types_dmah.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2696626a0be5877f445fb647c25ef43930c777e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b22722f45a29a7c0900b1d4d0bc5da5492ece10","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfc119a40c04bbe3daad826f2160ccbfae6c64ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93268","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:23.730","lastModified":"2026-10-19T10:17:18.230","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: skip extra isize expansion during mount to prevent deadlock\n\next4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty()\nwhile holding an active jbd2 handle.  During mount (!SB_ACTIVE), the\nexpand path may move xattrs to external blocks and release ea_inodes via\niput().  When !SB_ACTIVE, iput() calls write_inode_now() which acquires\ns_writepages_rwsem, creating a circular lock dependency:\n\n  s_writepages_rwsem --> jbd2_handle --> xattr_sem --> s_writepages_rwsem\n\nThis can be triggered via:\n\n  ext4_process_orphan() -> ext4_truncate() -> ext4_mark_inode_dirty()\n    -> ext4_try_to_expand_extra_isize()\n\nor:\n\n  ext4_evict_inode() -> ext4_mark_inode_dirty()\n    -> ext4_try_to_expand_extra_isize()\n\nSkip expansion when !SB_ACTIVE.  This is a minor loss of functionality\n(extra isize won't grow for these inodes during mount), which e2fsck\ncan resolve later if needed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ext4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"41897f1bcf4ace5f1f28d0be784b6f4f0e929641","versionType":"git","status":"affected"},{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"9c3469377b1d8caba6bec6ef3c460810bbfb02cc","versionType":"git","status":"affected"},{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"1dd4882dbdc8bfdf2182fa388883c143fac0902a","versionType":"git","status":"affected"},{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"7ba09330d9ea6e996228316719eae812d7e04983","versionType":"git","status":"affected"},{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"c5e6434cc55f30220b228be237bb666351f9f4dd","versionType":"git","status":"affected"},{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"7ace189b9ea79cf78df9c32b940ce12735f9459a","versionType":"git","status":"affected"},{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"2fb8ff81659a57c42bb7b49e8339a2be2a318ef8","versionType":"git","status":"affected"},{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"7461c60b9c6a839b13ad4c3490681a0cf5aa0637","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ext4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1dd4882dbdc8bfdf2182fa388883c143fac0902a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2fb8ff81659a57c42bb7b49e8339a2be2a318ef8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41897f1bcf4ace5f1f28d0be784b6f4f0e929641","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7461c60b9c6a839b13ad4c3490681a0cf5aa0637","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ace189b9ea79cf78df9c32b940ce12735f9459a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ba09330d9ea6e996228316719eae812d7e04983","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c3469377b1d8caba6bec6ef3c460810bbfb02cc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c5e6434cc55f30220b228be237bb666351f9f4dd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93269","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:23.873","lastModified":"2026-10-19T10:17:18.350","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix circular lock dependency in ext4_ext_migrate\n\nMove iput(tmp_inode) after ext4_writepages_up_write() to avoid a\ncircular lock dependency between s_writepages_rwsem and sb_internal\n(freeze protection).\n\nThe deadlock scenario:\n\n  CPU0 (EXT4_IOC_MIGRATE)        CPU1 (orphan cleanup during mount)\n  ----                           ----\n  ext4_ext_migrate()\n    ext4_writepages_down_write()\n      s_writepages_rwsem (write)\n                                 ext4_evict_inode()\n                                   sb_start_intwrite()   [sb_internal]\n                                   ...\n                                     ext4_writepages()\n                                       s_writepages_rwsem (read) [BLOCKED]\n    iput(tmp_inode)\n      ext4_evict_inode()\n        sb_start_intwrite()         [BLOCKED]\n\nThe tmp_inode is a temporary inode with nlink=0 created solely for\nbuilding the extent tree.  Its eviction does not require\ns_writepages_rwsem protection, so deferring iput() until after\nreleasing the rwsem is safe."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ext4/migrate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cb85f4d23f794e24127f3e562cb3b54b0803f456","lessThan":"452950461241dfed8b1d32e94b227db38c99c5af","versionType":"git","status":"affected"},{"version":"cb85f4d23f794e24127f3e562cb3b54b0803f456","lessThan":"ada23457d4748d6e9c36c6f871fc29a6f558c48c","versionType":"git","status":"affected"},{"version":"cb85f4d23f794e24127f3e562cb3b54b0803f456","lessThan":"e4223231b6860141813637a6413c2371ae4d6fa8","versionType":"git","status":"affected"},{"version":"cb85f4d23f794e24127f3e562cb3b54b0803f456","lessThan":"32f7ab52875ec7f800ca67e7176e5743a84baddf","versionType":"git","status":"affected"},{"version":"cb85f4d23f794e24127f3e562cb3b54b0803f456","lessThan":"a897682793eba5de51ee6f3152760374afa629cf","versionType":"git","status":"affected"},{"version":"eb799e163dc2bc1ea0a4820b66f79d32a5e907df","versionType":"git","status":"affected"},{"version":"bcc1eab71a67c46b9e24544ac7923f44444174ce","versionType":"git","status":"affected"},{"version":"8cf20fb73e73a4c4df0328b5297842c5ef34fdd9","versionType":"git","status":"affected"},{"version":"e5d25003d059649e18a249635ed5ca7a7b1de5ad","versionType":"git","status":"affected"},{"version":"69f8a7991fd93c49096ddd11574db3e7df238b7b","versionType":"git","status":"affected"},{"version":"4.9.215","lessThan":"4.10","versionType":"semver","status":"affected"},{"version":"4.14.172","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.107","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.23","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.5.7","lessThan":"5.6","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ext4/migrate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/32f7ab52875ec7f800ca67e7176e5743a84baddf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/452950461241dfed8b1d32e94b227db38c99c5af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a897682793eba5de51ee6f3152760374afa629cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ada23457d4748d6e9c36c6f871fc29a6f558c48c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e4223231b6860141813637a6413c2371ae4d6fa8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93270","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.020","lastModified":"2026-10-19T10:17:18.460","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn\n\nThe BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for\n'dst_reg = src_reg + <percpu_base_off>'.\n\nHowever, the interpreter ignores the 'off' at its ALU64_MOV_X label.\nThe 'off' indicates the insn is BPF_MOV64_PERCPU_REG insn. Then, when\nthe interpreter loads memory from the register, it will hit a page\nfault.\n\n[    2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034\n[    2.546485] #PF: supervisor read access in kernel mode\n[    2.547167] #PF: error_code(0x0000) - not-present page\n[    2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062\n[    2.548912] Oops: Oops: 0000 [#1] SMP PTI\n\nSet jit_required as true in order to disallow interpreter fallback in\ncore.c::__bpf_prog_select_runtime(), if any BPF_ADDR_PERCPU insn is\npatched to the prog.\n\nBTW, rename the helper bpf_map_supports_cpu_flags() to\nbpf_map_is_percpu_map()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/bpf.h","kernel/bpf/fixups.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7bdbf7446305cb65c510c16d57cde82bc76b234a","lessThan":"57cf929a33cb76be3f24886073ae820b4c496914","versionType":"git","status":"affected"},{"version":"7bdbf7446305cb65c510c16d57cde82bc76b234a","lessThan":"7a0855e73757ee9cf25ba635a1c735018ecba742","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/bpf.h","kernel/bpf/fixups.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/57cf929a33cb76be3f24886073ae820b4c496914","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a0855e73757ee9cf25ba635a1c735018ecba742","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93271","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.133","lastModified":"2026-10-19T10:17:18.557","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate\n\nath11k can receive HT/VHT/HE frames whose reported MCS is above the\nmaximum that can be expressed in the corresponding mac80211 rate space\n(e.g. an HE frame reported with MCS 12, while HE tops out at MCS 11).\n\nThe frame itself is valid and decodes correctly, but for such a frame\nath11k_dp_rx_h_rate() leaves rx_status->rate_idx set to the out-of-range\nvalue and never assigns rx_status->encoding, so it stays RX_ENC_LEGACY\nfrom the ath11k_dp_rx_h_ppdu() initialization. Once that frame reaches\nmac80211 it trips the rate sanity check and the frame is dropped with a\nsplat:\n\n  ath11k_pci 0000:03:00.0: Received with invalid mcs in HE mode 12\n  WARNING: CPU: 0 PID: 0 at net/mac80211/rx.c:5433 ieee80211_rx_list+0xb0a/0xe90 [mac80211]\n\nDropping the frame would discard otherwise valid data, so instead cap the\nreported MCS to the maximum the rate space can express and deliver the\nframe. Set rx_status->encoding before the range check and assign rate_idx\nfrom the capped value, so a frame with an out-of-range MCS no longer\nleaves partial or bogus rate metadata behind. Also downgrade the logging\nlevel since they are not treated as invalid frames now. The only loss is\nthat such a frame is reported as the capped MCS in the rx rate statistics.\n\nTested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"6ad04c3e2ec54bf5ec72c81afdd66318a116c539","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"a6b951f79e66fc8bd93a537ff1040fbfb567c8bf","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"b77bfe6e59b98dff3ccfcf9b45fc27e3db498626","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"fb7b9a7209f839c17c66484dfdc84c9a23c6fd2f","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"a0b3e6f9645d88f387c4fea546048a91952cd4cd","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"2bb2a778a487305bd378db5fd5014fbdce4ada2c","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"ccbd20f2168f581d90265da1a925b9b6472a0b05","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"12b09e478aa7459b7893a695ef77682202f2da83","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/12b09e478aa7459b7893a695ef77682202f2da83","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2bb2a778a487305bd378db5fd5014fbdce4ada2c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ad04c3e2ec54bf5ec72c81afdd66318a116c539","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0b3e6f9645d88f387c4fea546048a91952cd4cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6b951f79e66fc8bd93a537ff1040fbfb567c8bf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b77bfe6e59b98dff3ccfcf9b45fc27e3db498626","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ccbd20f2168f581d90265da1a925b9b6472a0b05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fb7b9a7209f839c17c66484dfdc84c9a23c6fd2f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93272","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.280","lastModified":"2026-10-21T13:21:07.297","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3\n\nThe changes introduced to handle single power domain platforms have\nswapped the info pointer increment from num_pd_vregs to num_pds, which\nwould shift the info pointer past the end of the array for pronto-v3,\nwhich does not list power domain regulators in vregs.\n\nThis showed up as a difference between GCC- and LLVM-compiled kernels\non SDM632 devices, where only with LLVM one would get the\n\"regulator request with no identifier\" error, because the out-of-bounds\nmemory ended up being zeroed. Fix by skipping the increment when there\nare more power domains than regulators."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/remoteproc/qcom_wcnss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fef1e1487dea81c2b4560e393ba4b0be57e28d01","lessThan":"7abab59d6c99ba2b8101d6f44ad25159b1510724","versionType":"git","status":"affected"},{"version":"69bb5b3ae348040e385113efba5bdc76396644d0","lessThan":"e572cbb513cde53d90fb4729cad75056cd647ce3","versionType":"git","status":"affected"},{"version":"65991ea8a6d1e68effdc01d95ebe39f1653f7b71","lessThan":"2e7e39bb81913feaac463b7add46bafdca06fbde","versionType":"git","status":"affected"},{"version":"65991ea8a6d1e68effdc01d95ebe39f1653f7b71","lessThan":"bce6b48af3abf7468d12ef4933f21bd8c1d822e9","versionType":"git","status":"affected"},{"version":"65991ea8a6d1e68effdc01d95ebe39f1653f7b71","lessThan":"3dbc90b9c22ea96e37bf55f6011e63b5123ec668","versionType":"git","status":"affected"},{"version":"654c295f9079d2c7875172142022168e34c4e34e","versionType":"git","status":"affected"},{"version":"8d0d4c11cace475f1b07f98ee3d2bd334590e17b","versionType":"git","status":"affected"},{"version":"04a89c98810d2dba8187120c07fdb732aa40ca14","versionType":"git","status":"affected"},{"version":"6.6.93","lessThan":"6.6.160","versionType":"semver","status":"affected"},{"version":"6.12.31","lessThan":"6.12.114","versionType":"semver","status":"affected"},{"version":"5.15.185","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.141","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.14.9","lessThan":"6.15","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/remoteproc/qcom_wcnss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2e7e39bb81913feaac463b7add46bafdca06fbde","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3dbc90b9c22ea96e37bf55f6011e63b5123ec668","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7abab59d6c99ba2b8101d6f44ad25159b1510724","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bce6b48af3abf7468d12ef4933f21bd8c1d822e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e572cbb513cde53d90fb4729cad75056cd647ce3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93273","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.400","lastModified":"2026-10-19T10:17:18.793","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: tps6594: Fix device node reference leaks in multiphase loop\n\nIn tps6594_regulator_probe(), the multi-phase configuration loop calls\nof_find_node_by_name() to find buck nodes by name, and of_get_parent()\ntwice to navigate to the PMIC parent node. None of the acquired node\nreferences (np, intermediate parent, np_pmic_parent) are ever released\nvia of_node_put(), causing a reference leak on every loop iteration.\n\nAdditionally, of_find_node_by_name() can return NULL, but the result was\nimmediately passed to of_node_full_name() and of_get_parent() without a\nNULL check, which could lead to a NULL pointer dereference.\n\nFix this by:\n- Adding a NULL check for np after of_find_node_by_name()\n- Storing the intermediate parent node in a local variable np_parent\n- Calling of_node_put() on np, np_parent and np_pmic_parent at the\n  end of each loop iteration"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/regulator/tps6594-regulator.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f17ccc5deb4d024bb52fd3433471e77ab7ae9ad8","lessThan":"28f70e0aa767a8f022c70ed75ecef227dc668121","versionType":"git","status":"affected"},{"version":"f17ccc5deb4d024bb52fd3433471e77ab7ae9ad8","lessThan":"4a672bff99f6b58dde419fd12b3a53da137f032d","versionType":"git","status":"affected"},{"version":"f17ccc5deb4d024bb52fd3433471e77ab7ae9ad8","lessThan":"68ce4f8223b78f8616ec7f4a02c38988eae627d2","versionType":"git","status":"affected"},{"version":"f17ccc5deb4d024bb52fd3433471e77ab7ae9ad8","lessThan":"fceac25487b21d6db940d2aed368e465d89cd1f4","versionType":"git","status":"affected"},{"version":"f17ccc5deb4d024bb52fd3433471e77ab7ae9ad8","lessThan":"7fd28093b3effc4f92566466df364622830ec608","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/regulator/tps6594-regulator.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/28f70e0aa767a8f022c70ed75ecef227dc668121","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a672bff99f6b58dde419fd12b3a53da137f032d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68ce4f8223b78f8616ec7f4a02c38988eae627d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7fd28093b3effc4f92566466df364622830ec608","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fceac25487b21d6db940d2aed368e465d89cd1f4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93274","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.527","lastModified":"2026-10-19T10:17:18.897","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: bcm2835: Don't remove an unregistered GPIO chip\n\nIf the devm_pinctrl_register() function fails,\nbcm2835_pinctrl_probe() calls gpiochip_remove()\nbefore gpiochip_add_data() has registered the GPIO chip.\n\nThis means that upon failure the gpio_chip.gpiodev\n is NULL resulting in a null pointer dereference\ninside the gpiochip_remove() function.\n\nRemove the unnecessary function call to gpiochip_remove().\nNo GPIO cleanup is required because the GPIO chip\nhas not yet been registered. Without this change there\nis potential for a kernel panic upon registration failure"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pinctrl/bcm/pinctrl-bcm2835.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ba696b470839d70c6b8290c1f798bac7fb2a584c","lessThan":"d428863ca8baa4e9eaf781266ac219b017dcf277","versionType":"git","status":"affected"},{"version":"79c6d4fa1be1fd0819c50ebb4dee101bbbc4d20e","lessThan":"f494cfc254cd509d7cbc44b843e0a6602a520a33","versionType":"git","status":"affected"},{"version":"266423e60ea1b953fcc0cd97f3dad85857e434d1","lessThan":"dd6b1919e41d1260259c4505777be565fb3a7efd","versionType":"git","status":"affected"},{"version":"266423e60ea1b953fcc0cd97f3dad85857e434d1","lessThan":"3b978fd0a3092b25561ac26bc1a87149fa981ddc","versionType":"git","status":"affected"},{"version":"266423e60ea1b953fcc0cd97f3dad85857e434d1","lessThan":"b8535f5c77cc61352d02a0c038a280127a8b8208","versionType":"git","status":"affected"},{"version":"266423e60ea1b953fcc0cd97f3dad85857e434d1","lessThan":"68ea6dd23b732081826c36033835468383487864","versionType":"git","status":"affected"},{"version":"266423e60ea1b953fcc0cd97f3dad85857e434d1","lessThan":"727f043d699ab0d5d87122c2177f2b45fbe58d35","versionType":"git","status":"affected"},{"version":"266423e60ea1b953fcc0cd97f3dad85857e434d1","lessThan":"32711f77db0641e57fd96fdc013bf1286b9f2514","versionType":"git","status":"affected"},{"version":"75278f1aff5e14c904d3503c6f836c42a7afb441","versionType":"git","status":"affected"},{"version":"5.10.89","lessThan":"5.10.270","versionType":"semver","status":"affected"},{"version":"5.15.12","lessThan":"5.15.221","versionType":"semver","status":"affected"},{"version":"5.4.175","lessThan":"5.5","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pinctrl/bcm/pinctrl-bcm2835.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/32711f77db0641e57fd96fdc013bf1286b9f2514","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b978fd0a3092b25561ac26bc1a87149fa981ddc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68ea6dd23b732081826c36033835468383487864","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/727f043d699ab0d5d87122c2177f2b45fbe58d35","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8535f5c77cc61352d02a0c038a280127a8b8208","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d428863ca8baa4e9eaf781266ac219b017dcf277","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd6b1919e41d1260259c4505777be565fb3a7efd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f494cfc254cd509d7cbc44b843e0a6602a520a33","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93275","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.667","lastModified":"2026-10-19T10:17:19.020","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/pt: Fix stop/start with no update\n\nIf pt_event_stop() is called without PERF_EF_UPDATE flag, then\nperf_aux_output_end() is not called.  A subsequent call to pt_event_start()\nwill call perf_aux_output_begin() again which violates the rule against\nnesting and triggers a WARNING in perf_aux_output_begin().\n\nOriginally, pt_event_stop() was never called without PERF_EF_UPDATE,\nbecause the only code paths to do so are from event overflow, and Intel PT\ndoes not do that.\n\nHowever the introduction of group throttling by commit 9734e25fbf5ae\n(\"perf: Fix the throttle logic for a group\") meant that an Intel PT event\ncould be throttled if it was part of a group.  Throttling calls PMU\n ->stop() / ->start() callbacks without flags.\n\nAn example is when AUX area sampling is used. The following commands\nhit the issue:\n\n  echo 10000 > /proc/sys/kernel/perf_event_max_sample_rate\n\n  perf record -F32000 --aux-sample -e '{intel_pt//u,cycles:u}' \\\n  -- bash -c 'for i in `seq 1 100000` ; do true ; done'\n\nUse PERF_HES_UPTODATE to track whether perf_aux_output_begin() and\nperf_aux_output_end() are balanced.  A cleared PERF_HES_UPTODATE bit\nindicates that an AUX output context is still open.\n\nAmend pt_event_start() / pt_event_stop() accordingly so that begin/end\nstay balanced:\n\n - In non-snapshot mode, stop() always closes the buffer (the buffer may\n   have run out of space, and that accounting is done by the update), so\n   a following start() opens a fresh one as before.\n\n - In snapshot/overwrite mode, stop() without PERF_EF_UPDATE leaves the\n   buffer open so that pt_event_snapshot_aux() can still copy from it,\n   and start() then only re-enables tracing instead of calling\n   perf_aux_output_begin() again.\n\nNote that pt_event_del() calls pt_event_stop() with PERF_EF_UPDATE flag set\n(as is required by the documentation), so a final call to\nperf_aux_output_end() is assured."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/events/intel/pt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9734e25fbf5ae68eb04234b2cd14a4b36ab89141","lessThan":"cab5015ee3f25f789b4a368f2abfa65536576b78","versionType":"git","status":"affected"},{"version":"9734e25fbf5ae68eb04234b2cd14a4b36ab89141","lessThan":"304844b5545f444d523286da8228a1cbc46ffffa","versionType":"git","status":"affected"},{"version":"9734e25fbf5ae68eb04234b2cd14a4b36ab89141","lessThan":"2e17bf3a469a41457a3bc31b1f8fd66b6ce94a6d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/events/intel/pt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2e17bf3a469a41457a3bc31b1f8fd66b6ce94a6d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/304844b5545f444d523286da8228a1cbc46ffffa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cab5015ee3f25f789b4a368f2abfa65536576b78","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93276","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.797","lastModified":"2026-10-19T10:17:19.130","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nphy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator\n\ndevm_regulator_get_exclusive() initialises the regulator with\nenable_count = 1, requiring the consumer to disable it before release.\n\nThe devm disable action was previously only registered when the caller\nexplicitly requested enable, so when the regulator was left in its initial\nenabled state without an explicit enable call, the cleanup path skipped\ndecrementing enable_count, triggering a WARN_ON during regulator\nrelease on device removal.\n\nFix this by always registering the devm disable action based on the actual\nenabled state via regulator_is_enabled(), regardless of whether the\ncaller requested an explicit enable. This covers both the explicitly\nenabled case and the initial state set by devm_regulator_get_exclusive()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/phy/renesas/phy-rcar-gen3-usb2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"24843404efe47eab1ee88d7475a0be0f2f6fd9db","lessThan":"bf7fefbc26e292c08cfe7b6496b879109ef1475a","versionType":"git","status":"affected"},{"version":"24843404efe47eab1ee88d7475a0be0f2f6fd9db","lessThan":"935f6e837a83b86b073a7601f699dc2c00e01322","versionType":"git","status":"affected"},{"version":"24843404efe47eab1ee88d7475a0be0f2f6fd9db","lessThan":"49c9b71b45081e5e5eeb507a2d6edb80d332dc59","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/phy/renesas/phy-rcar-gen3-usb2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/49c9b71b45081e5e5eeb507a2d6edb80d332dc59","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/935f6e837a83b86b073a7601f699dc2c00e01322","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf7fefbc26e292c08cfe7b6496b879109ef1475a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93277","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.907","lastModified":"2026-10-19T10:17:19.223","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Validate udata before executing commands\n\nThe destroy callbacks currently zero the udata output after tearing down\ndriver resources. If the userspace access fails, uverbs preserves the\nuobject and allows the destroy callback to run again, even though the\ndriver resource has already been freed.\n\nCall ib_no_udata_io() before teardown so udata failures are detected\nwhile the resource is still intact, then return success after teardown\ncompletes.\n\nAs part of this change, move ib_respond_empty_udata() to the start of\nthe create and modify flows. While this is not strictly required for\ngeneral create flows, as the core layer unwinds uobjects on failure, it\nis necessary for create AH. In _rdma_create_ah(), the HW object is\notherwise leaked."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/hw/bnxt_re/ib_verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bed686d8dcd4fbcaa18cf67468caaf8772acfc7a","lessThan":"c5643ea4f040acc2f4d1e88f49bd0be51110ff2f","versionType":"git","status":"affected"},{"version":"bed686d8dcd4fbcaa18cf67468caaf8772acfc7a","lessThan":"d38c835925d4a3bfdf0a85ff2829ee90c709c561","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/hw/bnxt_re/ib_verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/c5643ea4f040acc2f4d1e88f49bd0be51110ff2f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d38c835925d4a3bfdf0a85ff2829ee90c709c561","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93278","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:25.017","lastModified":"2026-10-19T10:17:19.330","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: octeon: add missing napi_disable in cvm_oct_rx_shutdown\n\ncvm_oct_rx_shutdown calls free_irq and netif_napi_del without\ndisabling the napi instance first. As the free_irq only waits\nfor completion of hard interrupt handlers, the napi poll\nfunction could still be active. If cvm_oct_remove proceeds to\nfree the plat structure (which holds the NAPI instances), the\nactive poll function will access freed memory, resulting in a\nuse-after-free crash."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/octeon/ethernet-rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3368c784bcf77124aaf39372e627016c36bd4472","lessThan":"158389d7af04bbf0664d91c2ce31fcc9eeace1eb","versionType":"git","status":"affected"},{"version":"3368c784bcf77124aaf39372e627016c36bd4472","lessThan":"c124049c3a7006fd6caf629139a5722610bbffb4","versionType":"git","status":"affected"},{"version":"3368c784bcf77124aaf39372e627016c36bd4472","lessThan":"98f9036b2254c928cb44da0c77dba38f66f7d8f1","versionType":"git","status":"affected"},{"version":"3368c784bcf77124aaf39372e627016c36bd4472","lessThan":"b38fbd68cc36b4f478a1e3cfc169b8616ae1337d","versionType":"git","status":"affected"},{"version":"3368c784bcf77124aaf39372e627016c36bd4472","lessThan":"89f9f433271fad9351de6a3c713b45b2cfb23e4a","versionType":"git","status":"affected"},{"version":"3368c784bcf77124aaf39372e627016c36bd4472","lessThan":"b2243ffaac14cc3639b5b32a371aac37f96ee554","versionType":"git","status":"affected"},{"version":"3368c784bcf77124aaf39372e627016c36bd4472","lessThan":"c0a9a8586a63fda49e61a6b83360feac2a60d898","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/octeon/ethernet-rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.34","status":"affected"},{"version":"0","lessThan":"2.6.34","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/158389d7af04bbf0664d91c2ce31fcc9eeace1eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/89f9f433271fad9351de6a3c713b45b2cfb23e4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98f9036b2254c928cb44da0c77dba38f66f7d8f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2243ffaac14cc3639b5b32a371aac37f96ee554","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b38fbd68cc36b4f478a1e3cfc169b8616ae1337d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0a9a8586a63fda49e61a6b83360feac2a60d898","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c124049c3a7006fd6caf629139a5722610bbffb4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93279","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:25.147","lastModified":"2026-10-19T10:17:19.447","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown\n\nThe TX cleanup tasklet can be scheduled by the watchdog IRQ handler\nto execute cvm_oct_tx_do_cleanup. There can be a pending tasklet in\nthe queue which might run after the cvm_oct_remove() frees net_device\nstructures, causing a use-after-free in cvm_oct_tx_do_cleanup() as it\niterates cvm_oct_device[] which is an array of netdevice pointers.\nAdd tasklet_kill() after free_irq() to ensure the tasklet is no longer\nscheduled or running before teardown proceeds."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/octeon/ethernet-tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"32efcb6d5f4e3f030e7b0a3ba5c6c0684dd07486","versionType":"git","status":"affected"},{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"d15226338dfaa84ffff142d32723cdf74d0c47c4","versionType":"git","status":"affected"},{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"a77efd85e0d48c877f66d2bc3ab89cc1b8dacd19","versionType":"git","status":"affected"},{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"b6365e4186322858a82c8713b1d0bd209c8e765a","versionType":"git","status":"affected"},{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"03d12490afd1198310ad0aba42462329832eb739","versionType":"git","status":"affected"},{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"2c0c9956596e48654bb4855e2a0742748a0826a7","versionType":"git","status":"affected"},{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"41a79bd9e5a74f8f483b3b206d10567912874fb4","versionType":"git","status":"affected"},{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"b9af44b0d20b2247c4eb0ea5cfca907d643eea50","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/octeon/ethernet-tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.34","status":"affected"},{"version":"0","lessThan":"2.6.34","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/03d12490afd1198310ad0aba42462329832eb739","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c0c9956596e48654bb4855e2a0742748a0826a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/32efcb6d5f4e3f030e7b0a3ba5c6c0684dd07486","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41a79bd9e5a74f8f483b3b206d10567912874fb4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a77efd85e0d48c877f66d2bc3ab89cc1b8dacd19","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6365e4186322858a82c8713b1d0bd209c8e765a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9af44b0d20b2247c4eb0ea5cfca907d643eea50","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d15226338dfaa84ffff142d32723cdf74d0c47c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93280","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:25.290","lastModified":"2026-10-19T10:17:19.560","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: audio: bound the topology section sizes against the fetched size\n\ngb_audio_gb_get_topology() fetches a topology blob of a module-supplied\nsize, and gbaudio_tplg_parse_data() then walks it by adding the\nmodule-supplied size_dais, size_controls and size_widgets fields to\nform the control, widget and route section offsets. Those le32 sizes\nare never checked against the fetched blob, so a module reporting a\nsmall topology size but large section sizes makes the offsets point\npast the allocation, and parsing reads out of bounds.\n\nReject a topology whose section sizes do not fit within the fetched\nsize before it is parsed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/greybus/audio_gb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"ba86de9f7b0d7903d2df5ea2373e34d8ca3fc43e","versionType":"git","status":"affected"},{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"dd5593aee0a0fb353e1164aff7b65e563fe1f232","versionType":"git","status":"affected"},{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"6f764363b3173d805be11e59a8f23ecee2d420d5","versionType":"git","status":"affected"},{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"52daf9de692ebac813d110eb1e677dc0e1f4a5ab","versionType":"git","status":"affected"},{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"d0f6eaba60705bacd9bb4ce48eab50ef3f546777","versionType":"git","status":"affected"},{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"c9191f2e2f35f1209eb2dc24b31129dd47b48c16","versionType":"git","status":"affected"},{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"cfcc5a41a9664eb68023aae4cd0d485b256bd7c7","versionType":"git","status":"affected"},{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"33d8c7b794d2a30637c9d3fcb478f1d3222bef1e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/greybus/audio_gb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/33d8c7b794d2a30637c9d3fcb478f1d3222bef1e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/52daf9de692ebac813d110eb1e677dc0e1f4a5ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f764363b3173d805be11e59a8f23ecee2d420d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba86de9f7b0d7903d2df5ea2373e34d8ca3fc43e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9191f2e2f35f1209eb2dc24b31129dd47b48c16","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfcc5a41a9664eb68023aae4cd0d485b256bd7c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0f6eaba60705bacd9bb4ce48eab50ef3f546777","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd5593aee0a0fb353e1164aff7b65e563fe1f232","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93281","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:25.440","lastModified":"2026-10-19T10:17:19.700","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: fix HE extended capability length check\n\nrtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability\nbyte 10, but rejects only datalen values below 10.  Byte 10 requires at\nleast 11 bytes.\n\nRequire datalen >= 11 before reading data[10]."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/realtek/rtw89/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8d540f9d29162e273797bef36686a010724f0f8a","lessThan":"eddf53f1edb0cf7f302bd15cdb47cca90948c205","versionType":"git","status":"affected"},{"version":"8d540f9d29162e273797bef36686a010724f0f8a","lessThan":"655c4401c18d735dbaf2cc172ff4f626b3a896a0","versionType":"git","status":"affected"},{"version":"8d540f9d29162e273797bef36686a010724f0f8a","lessThan":"bddbd1de765bf6ddc0473ad683910eb3a2a92a43","versionType":"git","status":"affected"},{"version":"8d540f9d29162e273797bef36686a010724f0f8a","lessThan":"f2a01deff7d0d5cc3dcbf2358dac113979303c8e","versionType":"git","status":"affected"},{"version":"8d540f9d29162e273797bef36686a010724f0f8a","lessThan":"f132fc01b359a0f7d81fe13d769ea4e7c4baa66e","versionType":"git","status":"affected"},{"version":"8d540f9d29162e273797bef36686a010724f0f8a","lessThan":"2aba608a86e9b099c9af2ea70b620552dee2b628","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/realtek/rtw89/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2aba608a86e9b099c9af2ea70b620552dee2b628","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/655c4401c18d735dbaf2cc172ff4f626b3a896a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bddbd1de765bf6ddc0473ad683910eb3a2a92a43","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eddf53f1edb0cf7f302bd15cdb47cca90948c205","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f132fc01b359a0f7d81fe13d769ea4e7c4baa66e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2a01deff7d0d5cc3dcbf2358dac113979303c8e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93282","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:25.570","lastModified":"2026-10-21T13:21:07.430","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix maximum allowed access checks\n\nThe DACL permission check looks for an ACE matching the current user and\nfalls back to the Everyone ACE. It does not consider an Authenticated\nUsers ACE, even though an authenticated session is a member of that\nwell-known group.\n\nAs a result, opening a file whose access is granted through S-1-5-11 can\nincorrectly fail with STATUS_ACCESS_DENIED. Treat an Authenticated Users\nACE as a fallback entry alongside Everyone.\n\nThe maximal access calculation also combines access masks from every ACE,\nregardless of whether its SID applies to the current user. This can grant\nrights belonging to an unrelated principal. Process only ACEs applying to\nthe user, Everyone, or Authenticated Users, and accumulate allowed and\ndenied masks in ACL order. Preserve explicitly requested access bits so\nthey are validated against the resulting maximal mask.\n\nWhen ACCESS_SYSTEM_SECURITY is denied, report STATUS_PRIVILEGE_NOT_HELD\ninstead of the generic STATUS_ACCESS_DENIED. Access to the system ACL\nrequires a security privilege that ksmbd does not grant.\n\nFor regular files, include FILE_EXECUTE in maximal access when the client\nrequested GENERIC_EXECUTE and the DACL grants the complete file-read set.\nKeep a direct FILE_EXECUTE request subject to the explicit DACL bit. This\nmatches the POSIX file ACL mapping without broadening specific execute\nrequests.\n\nDo not replace rights from an applicable NT ACE with a POSIX ACL entry.\nThe POSIX ACL is only a fallback when no user, Everyone, or Authenticated\nUsers ACE applies; otherwise it can incorrectly broaden the stored DACL.\n\nThis fixes smb2.maximum_allowed.maximum_allowed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/smb2pdu.c","fs/smb/server/smbacl.c","fs/smb/server/smbacl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"7c293e83d86cfd38124f51b27882ad631818bf48","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"37459edb69c094553026ee48c2cc2acc657f9f43","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"28289d880e6d11ae7ac77b81af3312453febf939","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"35d5c59fe6b1d9fe43fb14eb384f69ee1a120f9c","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"cc2f133e80eb2c4a04bfa77a2f207749fe2f516a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/smb2pdu.c","fs/smb/server/smbacl.c","fs/smb/server/smbacl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/28289d880e6d11ae7ac77b81af3312453febf939","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/35d5c59fe6b1d9fe43fb14eb384f69ee1a120f9c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/37459edb69c094553026ee48c2cc2acc657f9f43","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c293e83d86cfd38124f51b27882ad631818bf48","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc2f133e80eb2c4a04bfa77a2f207749fe2f516a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93283","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:25.690","lastModified":"2026-10-19T10:17:19.927","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: Fix device_register() error path\n\nWhen device_register() fails in i3c_master_register_new_i3c_devs(),\nput_device() is called to drop the reference taken by\ndevice_register().  That drops the last reference, so the device's\nrelease callback i3c_device_release() runs and frees the i3c_device.\n\nTwo problems follow from that:\n\ni3c_device_release() does WARN_ON(i3cdev->desc), so it warns because\ndesc->dev->desc still points back at the descriptor.  Clear it before\ncalling put_device().\n\nAfter put_device() frees the i3c_device, desc->dev is left pointing at\nfreed memory, so clear desc->dev as well.  That prevents, for example,\ni3c_master_unregister_i3c_devs() seeing desc->dev as non-NULL and\ndereferencing it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/i3c/master.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1832ed55df45f4145335ad992fb83813cdc58b5d","lessThan":"5bf498623f8397d45f85f14cd631c5e5a565c2fb","versionType":"git","status":"affected"},{"version":"d48fe8d98171e0fffdeaa8b37ce0a6444bff819b","lessThan":"20a2b6df91fd782ef2ff551febef594d0b46a9a7","versionType":"git","status":"affected"},{"version":"174ae0a3b89e7804e4ea3d31bd83d6e43f39568c","lessThan":"a14dbdf471001dd0601b0c491184990c178a199c","versionType":"git","status":"affected"},{"version":"e49a51a96b531f1b4bcd8d358e645b6c74ef67e6","lessThan":"d22ad96f1a0c89e0ba66a2facc7430f0923919e3","versionType":"git","status":"affected"},{"version":"cab63f64887616e3c4e31cfd8103320be6ebc8d3","lessThan":"7f8e2c4f3704d9774bb26b49b1ad6a60ae57d4a0","versionType":"git","status":"affected"},{"version":"cab63f64887616e3c4e31cfd8103320be6ebc8d3","lessThan":"7ef12e1dd06e442eebf370f6e53c41bd056d0f22","versionType":"git","status":"affected"},{"version":"cab63f64887616e3c4e31cfd8103320be6ebc8d3","lessThan":"6ecf17bf5fe8da51a6e3fc9e03a76898fcc5c6cf","versionType":"git","status":"affected"},{"version":"cab63f64887616e3c4e31cfd8103320be6ebc8d3","lessThan":"74be657d98a8d684c0475f3cbd450ef2a30ffc73","versionType":"git","status":"affected"},{"version":"204beeb509d37669de34560e83bb8abffe7ee63a","versionType":"git","status":"affected"},{"version":"b24cf43d9babf1265a2bb0ae8d198267cef43b83","versionType":"git","status":"affected"},{"version":"5.10.201","lessThan":"5.10.270","versionType":"semver","status":"affected"},{"version":"5.15.139","lessThan":"5.15.221","versionType":"semver","status":"affected"},{"version":"6.1.63","lessThan":"6.1.188","versionType":"semver","status":"affected"},{"version":"6.6.2","lessThan":"6.6.157","versionType":"semver","status":"affected"},{"version":"5.4.261","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"6.5.12","lessThan":"6.6","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/i3c/master.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/20a2b6df91fd782ef2ff551febef594d0b46a9a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5bf498623f8397d45f85f14cd631c5e5a565c2fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ecf17bf5fe8da51a6e3fc9e03a76898fcc5c6cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74be657d98a8d684c0475f3cbd450ef2a30ffc73","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ef12e1dd06e442eebf370f6e53c41bd056d0f22","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f8e2c4f3704d9774bb26b49b1ad6a60ae57d4a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a14dbdf471001dd0601b0c491184990c178a199c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d22ad96f1a0c89e0ba66a2facc7430f0923919e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93425","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:25.990","lastModified":"2026-09-24T18:19:07.280","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe argument quoting. An authenticated organization member with service:read permission can inject shell metacharacters into repoPath and execute arbitrary commands through child_process.exec as root in the Dokploy container. The supplied service identifier is used only to resolve the server and does not constrain repoPath. Because the standard deployment mounts /var/run/docker.sock, container-root command execution can be used to control Docker and compromise the host and its managed applications. This issue is fixed in version 0.29.13."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Dokploy","product":"dokploy","versions":[{"version":"< 0.29.13","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:17:31.094265Z","id":"CVE-2026-93425","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/Dokploy/dokploy/commit/16b5b7293f9883327a89c69fcb6e5718767b064a","source":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/releases/tag/v0.29.13","source":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-56g6-wjr4-5q7p","source":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-56g6-wjr4-5q7p","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-93541","sourceIdentifier":"meissner@suse.de","published":"2026-09-24T16:17:26.163","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a"}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"X.org","product":"libXi","defaultStatus":"unaffected","packageName":"libXi","repo":"https://gitlab.freedesktop.org/xorg/lib/libxi","versions":[{"version":"0","lessThan":"1.8.4","versionType":"rpm","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:19:51.914504Z","id":"CVE-2026-93541","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=7b6fffd13fd3914e0b39f3a4f131913da7f066e7","source":"meissner@suse.de"}]}},{"cve":{"id":"CVE-2026-96744","sourceIdentifier":"cna@mongodb.com","published":"2026-09-24T16:17:27.120","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value an application uses when acquiring or restoring a lock may take over or prematurely expire a lock held by another process, which can lead to duplicated or conflicting operations."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB","product":"Laravel MongoDB (PHP)","defaultStatus":"unaffected","versions":[{"version":"4.3.0","lessThan":"5.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:07:07.976230Z","id":"CVE-2026-96744","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-943"}]}],"references":[{"url":"https://github.com/mongodb/laravel-mongodb/pull/3579","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/laravel-mongodb/releases/tag/5.11.0","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-96745","sourceIdentifier":"cna@mongodb.com","published":"2026-09-24T16:17:27.293","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB","product":"PHP Driver","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.21.10","versionType":"semver","status":"affected"},{"version":"2.0.0","lessThan":"2.1.10","versionType":"semver","status":"affected"},{"version":"2.2.0","lessThan":"2.5.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:21:29.694907Z","id":"CVE-2026-96745","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/mongodb/mongo-php-driver/pull/2115","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.10","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-php-driver/releases/tag/2.1.10","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-php-driver/releases/tag/2.5.3","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq-rh2c","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-96746","sourceIdentifier":"cna@mongodb.com","published":"2026-09-24T16:17:27.460","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB","product":"C Driver","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.30.12","versionType":"semver","status":"affected"},{"version":"2.0.0","lessThan":"2.5.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:10:23.359575Z","id":"CVE-2026-96746","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/mongodb/mongo-c-driver/releases/tag/1.30.12","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.5","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-c-driver/security/advisories/GHSA-frjf-h5jg-4v46","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-96750","sourceIdentifier":"cna@mongodb.com","published":"2026-09-24T16:17:27.610","lastModified":"2026-09-25T04:17:50.150","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB","product":"Compass","defaultStatus":"unaffected","versions":[{"version":"1.44.0","lessThan":"1.49.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-96750","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/mongodb-js/compass/releases/tag/v1.49.12","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-96873","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-24T16:17:28.040","lastModified":"2026-09-24T20:02:50.260","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS.\n\nThis issue affects Mediawiki - CirrusSearch extension through 1.46.0."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - CirrusSearch Extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/g/mediawiki/extensions/CirrusSearch","versions":[{"version":"0","lessThanOrEqual":"1.46.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:37:53.640849Z","id":"CVE-2026-96873","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CirrusSearch/+/1344368","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T435234","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-97225","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T16:17:28.880","lastModified":"2026-09-25T15:17:57.237","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from remote. Upgrading to version 7.2.5-beta.6 mitigates this issue. This patch is called 70e7b6b58e464d7a015ba16e8d7574b420ee4877. Upgrading the affected component is advised. This issue is distinct from CVE-2026-47668."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"DbGate","cpes":["cpe:2.3:a:dbgate:dbgate:*:*:*:*:*:*:*:*"],"modules":["JSON Runner"],"versions":[{"version":"7.2.5-beta.0","status":"affected"},{"version":"7.2.5-beta.1","status":"affected"},{"version":"7.2.5-beta.2","status":"affected"},{"version":"7.2.5-beta.3","status":"affected"},{"version":"7.2.5-beta.4","status":"affected"},{"version":"7.2.5-beta.5","status":"affected"},{"version":"7.2.5-beta.6","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T14:20:48.991603Z","id":"CVE-2026-97225","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/dbgate/dbgate/","source":"cna@vuldb.com"},{"url":"https://github.com/dbgate/dbgate/commit/70e7b6b58e464d7a015ba16e8d7574b420ee4877","source":"cna@vuldb.com"},{"url":"https://github.com/dbgate/dbgate/pull/1527","source":"cna@vuldb.com"},{"url":"https://github.com/dbgate/dbgate/releases/tag/v7.2.5-beta.6","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97225","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908099","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409319","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409319/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97226","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T16:17:29.090","lastModified":"2026-09-24T18:19:09.063","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"DbGate","cpes":["cpe:2.3:a:dbgate:dbgate:*:*:*:*:*:*:*:*"],"modules":["files-style Endpoint"],"versions":[{"version":"7.2.0","status":"affected"},{"version":"7.2.1","status":"affected"},{"version":"7.2.2","status":"affected"},{"version":"7.2.3","status":"affected"},{"version":"7.2.4","status":"affected"},{"version":"7.2.5","status":"affected"},{"version":"7.3.1-premium-beta.0","status":"affected"},{"version":"7.3.1-premium-beta.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:20:59.603505Z","id":"CVE-2026-97226","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97226","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908139","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409320","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409320/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-26054","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:04.553","lastModified":"2026-09-28T16:17:14.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can use an attacker-controlled header length to bypass optional-field early returns and cause the decoder to read beyond a short heap buffer. Opening the crafted document can crash SumatraPDF. This issue is fixed in version 3.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"sumatrapdfreader","product":"sumatrapdf","versions":[{"version":"< 3.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T15:33:10.549166Z","id":"CVE-2026-26054","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/sumatrapdfreader/sumatrapdf/commit/24b9ce83383bbaa48b3efe00e4d30cccea126198","source":"security-advisories@github.com"},{"url":"https://github.com/sumatrapdfreader/sumatrapdf/issues/5318","source":"security-advisories@github.com"},{"url":"https://github.com/sumatrapdfreader/sumatrapdf/releases/tag/3.6rel","source":"security-advisories@github.com"},{"url":"https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-27p6-wrfp-pgm8","source":"security-advisories@github.com"},{"url":"https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-27p6-wrfp-pgm8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-47132","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:04.723","lastModified":"2026-09-24T18:17:13.453","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search  filter and enumerate active users. The endpoint escapes SQL string syntax but does not escape `%` and `_`, which remain active `LIKE` wildcards. Version 4.2.0-alpha patches the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"version":"< 4.2.0-alpha","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:06:01.241141Z","id":"CVE-2026-47132","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-89"},{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/commit/bd4b08b012234ccfcff07bfe6518062475b29e0a","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6pvm-2vjj-rx4w","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6pvm-2vjj-rx4w","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-56738","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:04.890","lastModified":"2026-10-05T16:17:14.313","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"phpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement using `sprintf()` and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, `StopWords::update()`, which modifies an existing stop word, correctly escapes the same kind of input. The omission is isolated to the `add()` (insert) code path. An authenticated administrator who can reach the stop-word management feature can submit a crafted value as the \"word\" parameter that breaks out of the SQL string literal and injects arbitrary SQL, including statements to drop tables, exfiltrate data, or modify other rows in the database. Version 4.1.6 fixes the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"version":"< 4.1.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:08.688016Z","id":"CVE-2026-56738","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/commit/d56ef5d75c3c007de095bc4c13b470c7ac783f0f","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rw77-vq4g-x3hp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-56744","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:05.047","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"`@bsv/wallet-toolbox` provides BRC-100 wallet signing and storage components, while `@bsv/wallet-toolbox-client` and `@bsv/wallet-toolbox-mobile` provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transactions created through a remote `StorageClient` to trust output locking scripts returned by the storage provider without verifying that they match the outputs requested by the caller. A malicious or compromised storage provider can substitute a recipient script or inject an additional output, causing the wallet to sign and broadcast a transaction that redirects funds while the application and user interface continue to display the intended recipient. Source and npm publication history indicate that stable versions `@bsv/wallet-toolbox` and `@bsv/wallet-toolbox-client` from 1.1.47 through 2.3.3, and `@bsv/wallet-toolbox-mobile` from its initial 1.3.21 release through 2.3.3, are affected. All three packages are patched in version 2.4.0. Applications unable to upgrade should avoid remote `StorageClient` providers, use local storage, or independently verify every transaction output’s locking script and value against the original request before signing"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"bsv-blockchain","product":"@bsv/wallet-toolbox","versions":[{"version":">= 1.1.47, < 2.4.0","status":"affected"}]},{"vendor":"bsv-blockchain","product":"@bsv/wallet-toolbox-client","versions":[{"version":">= 1.1.47, < 2.4.0","status":"affected"}]},{"vendor":"bsv-blockchain","product":"@bsv/wallet-toolbox-mobile","versions":[{"version":">= 1.3.21, < 2.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:17:06.726403Z","id":"CVE-2026-56744","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1288"}]}],"references":[{"url":"https://github.com/bsv-blockchain/ts-stack/commit/3a11f6111919245a3090e9f3895cfc4f21a80d28","source":"security-advisories@github.com"},{"url":"https://github.com/bsv-blockchain/ts-stack/commit/5492cabbef4ddc7f60cc49cdf5d8c74ed2e5d949","source":"security-advisories@github.com"},{"url":"https://github.com/bsv-blockchain/ts-stack/commit/5ee60395e78e8b822d9a78efeacc6039c249819b","source":"security-advisories@github.com"},{"url":"https://github.com/bsv-blockchain/ts-stack/security/advisories/GHSA-36f9-7rg5-cpf8","source":"security-advisories@github.com"},{"url":"https://github.com/bsv-blockchain/wallet-toolbox/commit/ca651b067c0238cd8b1ddd3af225daa503857a07","source":"security-advisories@github.com"},{"url":"https://github.com/bsv-blockchain/ts-stack/security/advisories/GHSA-36f9-7rg5-cpf8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-62368","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:05.207","lastModified":"2026-09-29T16:50:07.450","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes on page load in that user's Snipe-IT session. This can expose same-origin data and perform authenticated actions with the victim's privileges, including privilege escalation when a superuser views the affected list. This issue is fixed in version 8.7.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grokability","product":"snipe-it","versions":[{"version":"< 8.7.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.7,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:13:19.981641Z","id":"CVE-2026-62368","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*","versionEndExcluding":"8.7.0","matchCriteriaId":"F553C45E-A829-4438-BA02-5FA70B55FB5A"}]}]}],"references":[{"url":"https://github.com/grokability/snipe-it/commit/58754e4e3b86b58a0c4523012ef04a2ae990d2c8","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/grokability/snipe-it/releases/tag/v8.7.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-p9h3-gvpq-5539","source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"]},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-p9h3-gvpq-5539","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-63493","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:05.367","lastModified":"2026-09-29T18:49:38.127","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web middleware group but not the API middleware group. The advisory states that the resulting persistent API token can read and modify resources with the victim's permissions and, for an administrator, can reach the users/two_factor_reset endpoint. Resetting the administrator's enrolled second factor allows the password-holding attacker to enroll an attacker-controlled factor, take over the administrator's web account, and lock out the legitimate user. The token does not create a web session, but it provides broad API access while the same browser session remains blocked at the two-factor page. This vulnerability is fixed in 8.7.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grokability","product":"snipe-it","versions":[{"version":"< 8.7.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:54:07.180253Z","id":"CVE-2026-63493","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-288"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*","versionEndExcluding":"8.7.0","matchCriteriaId":"F553C45E-A829-4438-BA02-5FA70B55FB5A"}]}]}],"references":[{"url":"https://github.com/grokability/snipe-it/commit/87c362962a670f427be071850b218e43eff5d08e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/grokability/snipe-it/commit/c4ea7db51ca80bf11b1d04fbe46e4a64f54dc780","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/grokability/snipe-it/pull/19294","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/grokability/snipe-it/releases/tag/v8.7.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx","source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"]},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-63498","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:05.513","lastModified":"2026-09-29T16:50:21.113","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The app/Http/Controllers/Api/UploadedFilesController.php show() path does not apply the safe-inline allowlist used by the equivalent web controller, so the browser can process an attacker-controlled xml-stylesheet reference and execute JavaScript generated by the stylesheet in the Snipe-IT origin. A victim who is authorized to view the object must open the attachment URL, after which the script can read same-origin data and perform authenticated actions with the victim's privileges. This issue is fixed in version 8.7.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grokability","product":"snipe-it","versions":[{"version":"< 8.7.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T15:39:44.519362Z","id":"CVE-2026-63498","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*","versionEndExcluding":"8.7.0","matchCriteriaId":"F553C45E-A829-4438-BA02-5FA70B55FB5A"}]}]}],"references":[{"url":"https://github.com/grokability/snipe-it/commit/e929b31f0b183c5810bd2b833c1f6f643cbe5284","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/grokability/snipe-it/releases/tag/v8.7.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563","source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"]},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-79762","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:06.220","lastModified":"2026-09-28T16:17:15.227","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in src/backend/utils/user-crypto.ts. Because OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET are not configured by the project's default deployment artifacts, an attacker with an offline SQLite database copy can derive the wrapping key, recover each affected user's DEK, and decrypt stored SSH passwords, private keys, and key passphrases. Password-authenticated users are not affected by this specific key derivation path. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 1.7.0, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T15:35:15.154188Z","id":"CVE-2026-79762","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/401ec7e8fc7d7f63739112e0b0897d6c97208eb8","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-685g-ccvv-6p8m","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-685g-ccvv-6p8m","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-79763","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:06.370","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor regressed the two-factor check introduced for CVE-2026-45749. In src/backend/database/routes/user-totp-routes.ts, verifyTotpReauth returns success when bcrypt.compare validates the password, while each endpoint chooses password or totp_code as an interchangeable credential. An attacker who has a victim's authenticated session and knows the password can disable TOTP or regenerate and invalidate backup codes without an authenticator or valid second factor, weakening the account to single-factor authentication. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 2.4.0, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:08:38.740425Z","id":"CVE-2026-79763","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-308"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/22124e1bc49c8cedad57b31de9c51ad39f3d4432","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-x9h9-f7jc-8jwj","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-x9h9-f7jc-8jwj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-79764","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:06.510","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts an authenticated user's url query parameter and passes it to http.get or https.get without destination restrictions. In src/backend/database/routes/homepage-proxy-routes.ts, new URL performs only syntactic validation, allowing requests to loopback, RFC1918, link-local, and cloud metadata destinations. The endpoint returns the complete fetched JSON response, so a low-privilege or self-registered account can exfiltrate internal service data and cloud credentials. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 2.5.0, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:19:08.241522Z","id":"CVE-2026-79764","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/4b2a60a854281d0e12e7c9bcde71854a81999ea0","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-mwr3-35ph-pjqg","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-mwr3-35ph-pjqg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-79766","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:06.650","lastModified":"2026-09-29T03:17:18.247","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation into a certbot shell command through POST /users/acme-ssl-request. In src/backend/database/routes/acme-ssl-routes.ts, child_process.execSync invokes /bin/sh -c with those values only wrapped in double quotes, so shell metacharacters can execute arbitrary operating-system commands as the Termix backend process. Both HTTP webroot and DNS Cloudflare challenge modes are affected, and compromise exposes Termix databases, process secrets, stored credentials, and network reachability. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 2.4.1, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:51:48.135823Z","id":"CVE-2026-79766","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/c7a9063a72071153723e668787548766c971f029","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-pr55-25gf-5f9v","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-pr55-25gf-5f9v","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-84302","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:06.793","lastModified":"2026-09-24T18:19:03.923","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.7.0","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.1","status":"affected"},{"version":">= 2026.5.0-latest, < 2026.5.2","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:04:31.550424Z","id":"CVE-2026-84302","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/1566d04524c01472375944bbf7b198dd09a99427","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/23488b72a200228e805c4e6d970fbad216d328c5","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/38d10c0e5d1b76540d2860455e0290f8e975c9fd","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/b323702d87cd82c327c116d9566477f3c4f9635f","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42091","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-3rx9-fqgh-wfpc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-88367","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:06.973","lastModified":"2026-09-25T18:17:31.597","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division yields infinity, which is converted to int without range validation, resulting in undefined behavior and process termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:57:56.078398Z","id":"CVE-2026-88367","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-681"}]}],"references":[{"url":"https://github.com/memononen/nanosvg/issues/293","source":"cve@mitre.org"},{"url":"https://github.com/memononen/nanosvg/issues/293","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88372","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.083","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:57:29.323451Z","id":"CVE-2026-88372","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/libsndfile/libsndfile/issues/1151","source":"cve@mitre.org"},{"url":"https://github.com/libsndfile/libsndfile/issues/1151","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88373","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.197","lastModified":"2026-09-25T18:17:31.937","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data(). Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in undefined behavior, causing process termination in UBSan-instrumented builds and denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:24:11.917709Z","id":"CVE-2026-88373","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/strukturag/libde265/commit/f8d324914e43d92af23614f22959cf9eee7bf9ea","source":"cve@mitre.org"},{"url":"https://github.com/strukturag/libde265/issues/534","source":"cve@mitre.org"},{"url":"https://github.com/strukturag/libde265/issues/534","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88376","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.313","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). A specially crafted MP4 file containing an avcC or hvcC atom with a declared size smaller than the atom header size can cause the payload-size calculation to wrap to a large unsigned value. The resulting invalid buffer allocation and copy operations can cause application termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:12:59.862454Z","id":"CVE-2026-88376","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-191"}]}],"references":[{"url":"https://github.com/axiomatic-systems/Bento4/issues/1091","source":"cve@mitre.org"},{"url":"https://github.com/axiomatic-systems/Bento4/issues/1091","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88377","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.433","lastModified":"2026-09-29T03:17:20.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4_ATOM_HEADER_SIZE can cause AP4_AvccAtom::Create() or AP4_HvccAtom::Create() to underflow the payload-size calculation. The resulting oversized buffer operation can cause invalid or NULL pointers to be passed to the AP4_DataBuffer copy path, resulting in application termination and denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:34:23.040819Z","id":"CVE-2026-88377","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-191"}]}],"references":[{"url":"https://github.com/axiomatic-systems/Bento4/issues/1092","source":"cve@mitre.org"},{"url":"https://github.com/axiomatic-systems/Bento4/issues/1092","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88378","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.550","lastModified":"2026-09-29T03:17:21.100","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag()."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:31:06.896356Z","id":"CVE-2026-88378","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/bellard/quickjs/issues/549","source":"cve@mitre.org"},{"url":"https://github.com/bellard/quickjs/pull/553","source":"cve@mitre.org"},{"url":"https://github.com/bellard/quickjs/pull/553/changes/42526037cfc0b2a94a875c0de0f4bbeaf597a542","source":"cve@mitre.org"},{"url":"https://github.com/bellard/quickjs/issues/549","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88382","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.670","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:04:13.893816Z","id":"CVE-2026-88382","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-770"},{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"https://github.com/redis/hiredis/issues/1357","source":"cve@mitre.org"},{"url":"https://github.com/redis/hiredis/issues/1357","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88383","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.787","lastModified":"2026-10-06T18:16:57.693","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:34:46.122313Z","id":"CVE-2026-88383","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://github.com/libical/libical/issues/1361","source":"cve@mitre.org"},{"url":"https://github.com/libical/libical/pull/1363","source":"cve@mitre.org"},{"url":"https://github.com/libical/libical/pull/1363/changes/557d9c043733b33a8511dce41fdeeb508460d5a9","source":"cve@mitre.org"},{"url":"https://github.com/libical/libical/issues/1361","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88384","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.907","lastModified":"2026-09-24T21:08:22.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packed_data pointer. The OpaqueAttribute constructor passes the NULL pointer to memcpy() without validating the zero-size condition, resulting in undefined behavior and process termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:17:56.727213Z","id":"CVE-2026-88384","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/AcademySoftwareFoundation/openexr/issues/2612","source":"cve@mitre.org"},{"url":"https://github.com/AcademySoftwareFoundation/openexr/pull/2615","source":"cve@mitre.org"},{"url":"https://github.com/AcademySoftwareFoundation/openexr/pull/2615/changes/70ddecfe82d2566f3776b8ed923939afd47baca2","source":"cve@mitre.org"},{"url":"https://github.com/AcademySoftwareFoundation/openexr/issues/2612","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88385","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:08.023","lastModified":"2026-10-06T18:16:57.880","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulting in a persistent memory leak on each parsing attempt. Repeated attacker-controlled requests can cause cumulative memory exhaustion and denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:40:22.501112Z","id":"CVE-2026-88385","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-401"}]}],"references":[{"url":"https://github.com/michaelrsweet/mxml/commit/83ef80ae3c5413b73f501edb59ee74e31ce399d0","source":"cve@mitre.org"},{"url":"https://github.com/michaelrsweet/mxml/issues/356","source":"cve@mitre.org"},{"url":"https://github.com/michaelrsweet/mxml/issues/356","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88390","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:08.143","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0) allows crafted JavaScript input containing an overlong token to trigger a one-byte write beyond the JsLex.token buffer in RELEASE/NO_ASSERT builds. The out-of-bounds write corrupts the adjacent tokenValue pointer, resulting in memory corruption and potentially causing application crashes or denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:59:21.695501Z","id":"CVE-2026-88390","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/espruino/Espruino/commit/ecd7d43e084ba9aafa8245609347fe0f4383b38c","source":"cve@mitre.org"},{"url":"https://github.com/espruino/Espruino/issues/2744","source":"cve@mitre.org"},{"url":"https://github.com/espruino/Espruino/issues/2744","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-91122","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:08.393","lastModified":"2026-09-24T18:19:06.763","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer's session. Default Content Security Policy settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:25:16.666454Z","id":"CVE-2026-91122","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/c3993e318e172389be5c98455177876f1dd87dda","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/d7126af3264b672d2201d84c18a37cb8627424a8","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-8m44-f6g9-7cg7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91123","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:08.560","lastModified":"2026-09-24T18:19:06.883","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:11:25.606443Z","id":"CVE-2026-91123","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91132","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:08.723","lastModified":"2026-09-29T03:17:21.457","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:57:23.434341Z","id":"CVE-2026-91132","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/d88e02ceb2eede4d8b851d9fe8aef753f3aa40b9","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/db8064f2a2a2a3feb3308a1c932ac61d950c9e56","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-4q3q-hph3-3rvp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91133","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:08.893","lastModified":"2026-09-24T18:19:07.003","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:12:40.098136Z","id":"CVE-2026-91133","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-943"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91134","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:09.080","lastModified":"2026-09-29T03:17:21.580","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:56:20.350456Z","id":"CVE-2026-91134","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91160","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:09.257","lastModified":"2026-10-05T16:17:17.470","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When an allowed session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions, and deployments that issue only OPERATOR or ADMIN keys are not affected. This issue is fixed in version 0.23.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rmyndharis","product":"OpenWA","versions":[{"version":"< 0.23.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:53:06.862079Z","id":"CVE-2026-91160","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/rmyndharis/OpenWA/commit/acc23c3803c07f43791a92e8e48456572fd69bdc","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/commit/b9d9ea1c57bde98b7833a5d6e482998703667ef0","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/pull/1602","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/releases/tag/v0.23.5","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/security/advisories/GHSA-m427-j4h4-9qwj","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91161","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:09.437","lastModified":"2026-10-05T16:17:17.610","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code endpoint and the GroupGetInviteCode MCP tool have no OPERATOR role requirement, allowing a valid VIEWER key scoped to a session to retrieve an active group invite code. The invite code is a transferable WhatsApp bearer capability, so an external account can join a group administered by the session without an OpenWA credential, gain read and post access to the group, and retain membership after the VIEWER key is revoked. Affected deployments are those that issue VIEWER keys to parties who should not be able to add accounts to administered groups; OPERATOR and ADMIN access is intended. This issue is fixed in version 0.23.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rmyndharis","product":"OpenWA","versions":[{"version":"< 0.23.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:07.290059Z","id":"CVE-2026-91161","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/rmyndharis/OpenWA/commit/a888a0121543426d4e1bf55f9edaed8306ae2699","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/commit/d66439db9653c7aa7cbfb763003c8d3cbc8f623c","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/pull/1572","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/releases/tag/v0.23.5","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/security/advisories/GHSA-45fh-xj7x-vj2x","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-93284","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:09.587","lastModified":"2026-10-19T10:17:20.043","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/pagemap: dma-unmap pages before handling migration errors\n\ndrm_pagemap_migrate_unmap_pages() relies on the pages array to determine\nwhich pages require DMA unmapping. However,\ndrm_pagemap_migration_unlock_put_pages() clears the array as part of its\ncleanup, leaving drm_pagemap_migrate_unmap_pages() with no valid page\ninformation if it is called afterward.\n\nCall drm_pagemap_migrate_unmap_pages() before\ndrm_pagemap_migration_unlock_put_pages() so the pages array remains\nvalid during DMA unmapping."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/drm_pagemap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f86ad0ed620cb3c91ec7d5468e93ac68d727539d","lessThan":"e4331c6644db85bc6ceb470bd84bcf371b6dbfa6","versionType":"git","status":"affected"},{"version":"f86ad0ed620cb3c91ec7d5468e93ac68d727539d","lessThan":"415f5a755cec5164b149037bf294e270b78d36c6","versionType":"git","status":"affected"},{"version":"f86ad0ed620cb3c91ec7d5468e93ac68d727539d","lessThan":"9e6372ec2a3990662ae0a67f56ac0aee19848d5b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/drm_pagemap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.9","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/415f5a755cec5164b149037bf294e270b78d36c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e6372ec2a3990662ae0a67f56ac0aee19848d5b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e4331c6644db85bc6ceb470bd84bcf371b6dbfa6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93285","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:09.697","lastModified":"2026-10-21T13:21:07.627","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: embed f2fs_gc_kthread in f2fs_sb_info\n\nInstead of allocating f2fs_gc_kthread dynamically, embed it in\nf2fs_sb_info. This simplifies lifetime management and prepares for\nfixing race conditions during teardown.\n\n- __sbi_store\t\t\t- remount|shutdown\n\t\t\t\t - f2fs_stop_gc_thread\n - access sbi->gc_thread\n\t\t\t\t  - sbi->gc_thread = NULL\n - access sbi->gc_thread->f2fs_gc_task"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/f2fs/debug.c","fs/f2fs/f2fs.h","fs/f2fs/gc.c","fs/f2fs/gc.h","fs/f2fs/segment.c","fs/f2fs/super.c","fs/f2fs/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7950e9ac638e84518fbdd5c930939ad46a1068c5","lessThan":"cc004a1107e2c44cbdd2f1b1c2c85d32adc8f731","versionType":"git","status":"affected"},{"version":"7950e9ac638e84518fbdd5c930939ad46a1068c5","lessThan":"7ee6be9ee7f9a803e0f539af26ab1154fdde48ba","versionType":"git","status":"affected"},{"version":"7950e9ac638e84518fbdd5c930939ad46a1068c5","lessThan":"23eee01c732ec8c62b05416a05f0f88129df2960","versionType":"git","status":"affected"},{"version":"7950e9ac638e84518fbdd5c930939ad46a1068c5","lessThan":"99d14d61aa8beb6cb9a984b9fcddd45e35b24494","versionType":"git","status":"affected"},{"version":"7950e9ac638e84518fbdd5c930939ad46a1068c5","lessThan":"3d7bca9d583793bb7d0bac0d95a24ddd2e129eed","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/f2fs/debug.c","fs/f2fs/f2fs.h","fs/f2fs/gc.c","fs/f2fs/gc.h","fs/f2fs/segment.c","fs/f2fs/super.c","fs/f2fs/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/23eee01c732ec8c62b05416a05f0f88129df2960","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3d7bca9d583793bb7d0bac0d95a24ddd2e129eed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ee6be9ee7f9a803e0f539af26ab1154fdde48ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/99d14d61aa8beb6cb9a984b9fcddd45e35b24494","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc004a1107e2c44cbdd2f1b1c2c85d32adc8f731","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93286","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:09.810","lastModified":"2026-10-03T11:17:47.133","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: appletalk: fix NULL pointer dereference in aarp_send_ddp()\n\naarp_send_ddp() calls atalk_find_dev_addr(dev) in the LocalTalk fast\npath without checking for NULL. When the device has no AppleTalk\ninterface configured (dev->atalk_ptr == NULL), this leads to a NULL\npointer dereference at the at->s_net access.\n\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:aarp_send_ddp (net/appletalk/aarp.c:552 (discriminator 2))\n Call Trace:\n  <TASK>\n  atalk_sendmsg (net/appletalk/ddp.c:1715)\n  __sys_sendto (net/socket.c:2265 (discriminator 1))\n  __x64_sys_sendto (net/socket.c:2272)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nAdd a NULL check consistent with the other callers of\natalk_find_dev_addr()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/appletalk/aarp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"51cc5e756cec6071ffc620076aebcf5bae936668","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8c4b9ceb1be780588c1c50d573d5ee308e0874d2","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d643fd42ad96f19b5ce5cb11824fefa617191dbe","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"542c1dd41e1b0cd1c2c3ba8091c7d882eea0d680","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8fc30f0cdf4207a5aa2341c0a98d0f1713b3ce2c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"83899a056aeb120898a6e3a989971fc63e274e2e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9e7f36ab5b7bf68463faa5f7b926fea8f35597bb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/appletalk/aarp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/51cc5e756cec6071ffc620076aebcf5bae936668","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/542c1dd41e1b0cd1c2c3ba8091c7d882eea0d680","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83899a056aeb120898a6e3a989971fc63e274e2e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c4b9ceb1be780588c1c50d573d5ee308e0874d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8fc30f0cdf4207a5aa2341c0a98d0f1713b3ce2c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e7f36ab5b7bf68463faa5f7b926fea8f35597bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d643fd42ad96f19b5ce5cb11824fefa617191dbe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93287","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:09.930","lastModified":"2026-10-03T11:17:47.247","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: smbus: reject oversized block transfers in the common path\n\nThe SMBus block transfer length data->block[0] is validated in\ni2c_smbus_xfer_emulated() but that check runs too late for tracepoints\nand is skipped entirely when the adapter provides a native smbus_xfer\nimplementation. This allows user-controlled oversized block lengths to\nreach tracepoint memcpy calls and driver callbacks unchecked.\n\nAdd an early validation in __i2c_smbus_xfer() that rejects block\ntransfers whose caller-supplied length is zero or exceeds\nI2C_SMBUS_BLOCK_MAX before any tracepoint fires or driver callback\nruns. data->block[0] is filled in by the device on SMBus block reads,\nso the check is scoped to operations where the length is actually\nsupplied by the caller. This is consistent with the existing -EINVAL\nconvention in the emulated path and protects all downstream consumers\nat once: the smbus_write tracepoint, all native smbus_xfer driver\nimplementations, and the emulated path.\n\nTwo distinct bugs are fixed by this change:\n\nBug 1: smbus_write tracepoint OOB (include/trace/events/smbus.h)\n  trace_smbus_write() fires before any validation and copies\n  data->block[0]+1 bytes into a 34-byte event buffer. With\n  block[0]=0xfe the tracepoint copies 255 bytes, overflowing by 221.\n\n BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_smbus_write+0x27c/0x530\n Read of size 255 at addr ffff88800d98fcf8 by task poc_smbus/91\n Call Trace:\n  <TASK>\n  __asan_memcpy+0x23/0x80\n  trace_event_raw_event_smbus_write+0x27c/0x530\n  __i2c_smbus_xfer+0x43a/0xa40\n  i2c_smbus_xfer+0x19e/0x340\n  i2cdev_ioctl_smbus+0x38f/0x7f0\n  i2cdev_ioctl+0x35e/0x680\n  __x64_sys_ioctl+0x147/0x1e0\n  do_syscall_64+0xcf/0x15a0\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  </TASK>\n\nBug 2: i2c-stub I2C_SMBUS_I2C_BLOCK_DATA OOB (drivers/i2c/i2c-stub.c)\n  stub_xfer() implements .smbus_xfer directly and only clamps\n  block[0] against 256-command, not I2C_SMBUS_BLOCK_MAX. With\n  block[0]=0xff and command=0 the loop accesses block[1+i] for\n  i up to 254, far past the 34-byte union.\n\n UBSAN: array-index-out-of-bounds in drivers/i2c/i2c-stub.c:223:44\n index 34 is out of range for type '__u8 [34]'\n Call Trace:\n  <TASK>\n  __ubsan_handle_out_of_bounds+0xd7/0x120\n  stub_xfer+0x1971/0x198f [i2c_stub]\n  __i2c_smbus_xfer+0x306/0xa40\n  i2c_smbus_xfer+0x19e/0x340\n  i2cdev_ioctl_smbus+0x38f/0x7f0\n  i2cdev_ioctl+0x35e/0x680\n  __x64_sys_ioctl+0x147/0x1e0\n  do_syscall_64+0xcf/0x15a0\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  </TASK>\n\nBoth traces reproduced on v7.0-rc6+i2c/for-current with KASAN+UBSAN."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/i2c/i2c-core-smbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"856dffcc097b3d8ed45a643ebda07cb92968cb33","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"356875e33f2c6d2061a02c9dec1a1e639d265a55","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"72ca5e0b8b7a62615758f8871c34d61616c2dc8b","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"df077253f6405d67ad087538e495ef32a05717b7","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"f09edffba97d37b1fdff5f818a9a45f8a98ac171","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"c4b478bc50b7ca9865e237909941253a0f7111a2","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"3051cd060fa496df42954291fa2306ed2eab4ecc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/i2c/i2c-core-smbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.33","status":"affected"},{"version":"0","lessThan":"2.6.33","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3051cd060fa496df42954291fa2306ed2eab4ecc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/356875e33f2c6d2061a02c9dec1a1e639d265a55","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72ca5e0b8b7a62615758f8871c34d61616c2dc8b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/856dffcc097b3d8ed45a643ebda07cb92968cb33","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4b478bc50b7ca9865e237909941253a0f7111a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df077253f6405d67ad087538e495ef32a05717b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f09edffba97d37b1fdff5f818a9a45f8a98ac171","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93288","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:10.070","lastModified":"2026-10-03T11:17:47.413","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state\n\nsashiko reports: \"nfnl_log_net_exit() calls nf_log_unset(), which\nclears the logger pointer without an RCU grace period.  Immediately after,\nops_free_list() frees the per-net state while concurrent packets might\nstill be executing nf_log_packet() under rcu_read_lock().\"\n\nClear the pointer via .pre_exit to make sure rcu readers have completed\nbefore pernet storage is free'd.  The change in nf_log_syslog.c is only\ndone for consistency: it doesn't use pernet data."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nf_log_syslog.c","net/netfilter/nfnetlink_log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c83fa19603bdaeef17b815713dbbe3230c8a34ee","lessThan":"ba2e246aa294f9acd86194ea87fb6834ed0a37ac","versionType":"git","status":"affected"},{"version":"c83fa19603bdaeef17b815713dbbe3230c8a34ee","lessThan":"5570d6c8b320dbcc602617ee08c27ce752fed65a","versionType":"git","status":"affected"},{"version":"c83fa19603bdaeef17b815713dbbe3230c8a34ee","lessThan":"3b9aa62d78ce80de47af2db472ff452398755213","versionType":"git","status":"affected"},{"version":"c83fa19603bdaeef17b815713dbbe3230c8a34ee","lessThan":"f4461654374576e9d5d0245fd534c46ad8509051","versionType":"git","status":"affected"},{"version":"c83fa19603bdaeef17b815713dbbe3230c8a34ee","lessThan":"dc20050b6b12ca58066715d088e1a537535d938d","versionType":"git","status":"affected"},{"version":"c83fa19603bdaeef17b815713dbbe3230c8a34ee","lessThan":"33d1469b0124cc0baaea7a2032123b77a81e0940","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/nf_log_syslog.c","net/netfilter/nfnetlink_log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/33d1469b0124cc0baaea7a2032123b77a81e0940","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b9aa62d78ce80de47af2db472ff452398755213","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5570d6c8b320dbcc602617ee08c27ce752fed65a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba2e246aa294f9acd86194ea87fb6834ed0a37ac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc20050b6b12ca58066715d088e1a537535d938d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f4461654374576e9d5d0245fd534c46ad8509051","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93542","sourceIdentifier":"meissner@suse.de","published":"2026-09-24T17:17:10.183","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"x.org","product":"libXi","defaultStatus":"unaffected","packageName":"libXi","repo":"https://gitlab.freedesktop.org/xorg/lib/libxi","versions":[{"version":"0","lessThan":"1.8.4","versionType":"rpm","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:18:15.511330Z","id":"CVE-2026-93542","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=f499944ad595b9bd7e7571c810842244caf150aa","source":"meissner@suse.de"}]}},{"cve":{"id":"CVE-2026-93543","sourceIdentifier":"meissner@suse.de","published":"2026-09-24T17:17:10.307","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"x.org","product":"libXi","defaultStatus":"unaffected","packageName":"libXi","repo":"https://gitlab.freedesktop.org/xorg/lib/libxi","versions":[{"version":"0","lessThan":"1.8.4","versionType":"rpm","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:16:58.657195Z","id":"CVE-2026-93543","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=e2089ab748828273f916bbffd4e65b506aa50fdc","source":"meissner@suse.de"}]}},{"cve":{"id":"CVE-2026-93544","sourceIdentifier":"meissner@suse.de","published":"2026-09-24T17:17:10.430","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"x.org","product":"libXi","defaultStatus":"unaffected","packageName":"libXi","repo":"https://gitlab.freedesktop.org/xorg/lib/libxi","versions":[{"version":"0","lessThan":"1.8.4","versionType":"rpm","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:16:25.106730Z","id":"CVE-2026-93544","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=a88a341135b79f6ed450f481e4a5d6ba502382af","source":"meissner@suse.de"}]}},{"cve":{"id":"CVE-2026-93545","sourceIdentifier":"meissner@suse.de","published":"2026-09-24T17:17:10.550","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"x.org","product":"libXi","defaultStatus":"unaffected","packageName":"libXi","repo":"https://gitlab.freedesktop.org/xorg/lib/libxi","versions":[{"version":"0","lessThan":"1.8.4","versionType":"rpm","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:14:35.552977Z","id":"CVE-2026-93545","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=234ce17d95c42d75f7f7fdb2bf7a24875451bc0a","source":"meissner@suse.de"}]}},{"cve":{"id":"CVE-2026-93781","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:10.670","lastModified":"2026-10-03T11:17:47.550","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Do not block on tag allocation in scsi_eh_lock_door()\n\nscsi_eh_lock_door() is called from scsi_restart_operations() while the\nhost is still in the SHOST_RECOVERY state, i.e. before the host is\nswitched back to SHOST_RUNNING and scsi_run_host_queues() restarts the\nqueues. It allocates a request via scsi_alloc_request() with no flags,\nso blk_mq_get_tag() may block waiting for a free sched tag when all tags\nare already in use.\n\nThose tags can be held by commands that were just requeued by\nscsi_eh_flush_done_q() during error handling. Such commands cannot be\ndispatched until the host leaves SHOST_RECOVERY and\nscsi_run_host_queues() is called - which only happens *after*\nscsi_eh_lock_door() returns.\n\nThis forms a circular dependency:\n\n  - scsi_eh_lock_door(), running in the SCSI error handler thread, waits\n    for a sched tag held by a requeued command;\n\n  - the requeued command cannot complete and release its sched tag until\n    the error handler thread leaves scsi_restart_operations() and restart\n    the queues.\n\nFor devices with a single driver tag (e.g. USB storage) it is a\nguaranteed deadlock and I/O that can never be submitted. This problem\nhas also been reproduced in our environment.\n\nLocking the door is a best-effort operation, and scsi_eh_lock_door()\nalready returns silently when the request allocation fails. Pass\nBLK_MQ_REQ_NOWAIT to scsi_alloc_request() so the allocation fails\ninstead of blocking when no tag is available. This breaks the circular\ndependency and allows the error handler to finish restarting the queues,\nafter which the pending commands are dispatched normally."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/scsi_error.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6e68af666f5336254b5715dca591026b7324499a","lessThan":"3bc7af4cefac1c583f0607f6183a67012436aad9","versionType":"git","status":"affected"},{"version":"6e68af666f5336254b5715dca591026b7324499a","lessThan":"6b450c277c106c4e31411067f025d1aaa27c2a02","versionType":"git","status":"affected"},{"version":"6e68af666f5336254b5715dca591026b7324499a","lessThan":"261c80a6b23e34ba98bcf3f75317e35ecf0a08f0","versionType":"git","status":"affected"},{"version":"6e68af666f5336254b5715dca591026b7324499a","lessThan":"dc9e1b6b9080dd6374cc9a38e4b53abca63c3b1b","versionType":"git","status":"affected"},{"version":"6e68af666f5336254b5715dca591026b7324499a","lessThan":"732cb6bb37fd26863d5786522fb1997e7f5865b4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/scsi_error.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.16","status":"affected"},{"version":"0","lessThan":"2.6.16","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/261c80a6b23e34ba98bcf3f75317e35ecf0a08f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3bc7af4cefac1c583f0607f6183a67012436aad9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b450c277c106c4e31411067f025d1aaa27c2a02","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/732cb6bb37fd26863d5786522fb1997e7f5865b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc9e1b6b9080dd6374cc9a38e4b53abca63c3b1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93782","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:10.793","lastModified":"2026-10-03T11:17:47.667","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: flush backend after device ioctls\n\nvhost-scsi translates guest response descriptors into userspace iovecs\nwhen commands are submitted.  Target-core completes those commands\nasynchronously, so VHOST_SET_MEM_TABLE can replace the memory table while\nan in-flight command still retains response iovecs translated through the\nold table.\n\nIf the old mapping is reused after VHOST_SET_MEM_TABLE returns, command\ncompletion can write the response to an unrelated userspace object.\n\nFlush the vhost-scsi backend after vhost_dev_ioctl() handles a device\nioctl.  This waits for in-flight commands that can still use the old\nresponse iovecs before the ioctl returns."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/vhost/scsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","lessThan":"6436411203d8c702ffc055700f1a6bde488ff681","versionType":"git","status":"affected"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","lessThan":"cec088285adcc7ae23c119b6bbdb22270dc2de8f","versionType":"git","status":"affected"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","lessThan":"e0bf6bed528693a6b32439ab122b34a34b66d96f","versionType":"git","status":"affected"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","lessThan":"be2636e1b21fe860db918152abf2932638d06ed7","versionType":"git","status":"affected"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","lessThan":"981c97d09c6b9560bb12dcc41f11ce59b1a48e97","versionType":"git","status":"affected"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","lessThan":"6c1b802e36b05ebd9d41686c4dce6f06966af469","versionType":"git","status":"affected"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","lessThan":"22598f55a4c2b510b3df5e69e563387a963222ae","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/vhost/scsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.6","status":"affected"},{"version":"0","lessThan":"3.6","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.1,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/22598f55a4c2b510b3df5e69e563387a963222ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6436411203d8c702ffc055700f1a6bde488ff681","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6c1b802e36b05ebd9d41686c4dce6f06966af469","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/981c97d09c6b9560bb12dcc41f11ce59b1a48e97","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be2636e1b21fe860db918152abf2932638d06ed7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cec088285adcc7ae23c119b6bbdb22270dc2de8f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e0bf6bed528693a6b32439ab122b34a34b66d96f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93783","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:10.907","lastModified":"2026-10-03T11:17:47.810","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: validate skb length in rfcomm_recv_frame\n\nrfcomm_recv_frame() casts skb->data to struct rfcomm_hdr and dereferences\nhdr->addr and hdr->ctrl without validating skb->len first. A truncated\nframe with skb->len less than the minimum header size causes an\nout-of-bounds read of uninitialized memory. Additionally, a zero-length\nframe causes skb->len-- to underflow to UINT_MAX, making\nskb_tail_pointer() read far past the buffer.\n\nCommit 23882b828c3c (\"Bluetooth: RFCOMM: validate skb length in MCC\nhandlers\") fixed the same class of missing-length-check bugs in the MCC\nsub-handlers, but the top-level rfcomm_recv_frame() was left unfixed.\nKMSAN reports:\n\n  BUG: KMSAN: uninit-value in rfcomm_run\n  ...\n  Uninit was created at:\n    __alloc_skb+0x474/0xb60\n    vhci_write+0xe9/0x870\n\nFix this by rejecting frames smaller than sizeof(struct rfcomm_hdr) + 1\n(the minimum frame must have a 3-byte header and a 1-byte FCS)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/rfcomm/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"fb40eda15122f6b780228639c1ead6820340ff54","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3829af5fab5a22405bf1e7d69068c2ec0fce46ca","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b161eacd7fa4a2d765724b5504ac6cc388e48f80","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"30d1d9f3495463f7c026e4c553127f79b486fcd6","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"67dc3b40fae71b6b11c71e7ff69bac0758818c05","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"bbc310caa2b6bf5fe42896ba27da0fbc12e4ac51","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b230e5bf501c5edaf2eb0991cb862ac142031d4b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/rfcomm/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/30d1d9f3495463f7c026e4c553127f79b486fcd6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3829af5fab5a22405bf1e7d69068c2ec0fce46ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/67dc3b40fae71b6b11c71e7ff69bac0758818c05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b161eacd7fa4a2d765724b5504ac6cc388e48f80","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b230e5bf501c5edaf2eb0991cb862ac142031d4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bbc310caa2b6bf5fe42896ba27da0fbc12e4ac51","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fb40eda15122f6b780228639c1ead6820340ff54","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93784","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.017","lastModified":"2026-10-03T11:17:47.927","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()\n\nThe KASAN allocation trace shows that a malformed IE buffer is\nstored via SIOCSIWGENIE (cfg80211_wext_siwgenie()) without any\nvalidation. The crash trace shows that a subsequent SIOCSIWESSID\ntriggers a connection attempt which calls cfg80211_sme_get_conn_ies()\nto process the stored IE buffer, causing:\n\n - An out-of-bounds read in skip_ie() which reads ies[pos+1]\n   (the length byte) past the end of the 1-byte buffer.\n\n - An integer underflow in the memcpy size argument when offs\n   returned by ieee80211_ie_split() exceeds ies_len, causing\n   unsigned subtraction to wrap to SIZE_MAX and triggering a\n   fortify panic.\n\nFix this by validating the IE buffer in cfg80211_wext_siwgenie()\nbefore storing it.\n\n[drop unnecessary ie_len check, update commit message]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/wext-sme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f21293549f60f88c74fcb9944737f11048896dc4","lessThan":"269498ce6c1e2132b072aa0c8660404926008f03","versionType":"git","status":"affected"},{"version":"f21293549f60f88c74fcb9944737f11048896dc4","lessThan":"685082f4be77f4657b498ebbe9f942ef65c492cf","versionType":"git","status":"affected"},{"version":"f21293549f60f88c74fcb9944737f11048896dc4","lessThan":"8b921a8993469a3482e0c67b5ce5cb6ce93f5f61","versionType":"git","status":"affected"},{"version":"f21293549f60f88c74fcb9944737f11048896dc4","lessThan":"d01f1600e8b075aa17adb751ac9881bb6ee40dcc","versionType":"git","status":"affected"},{"version":"f21293549f60f88c74fcb9944737f11048896dc4","lessThan":"c970879e03b23a27df42caf7ba506485a165fb96","versionType":"git","status":"affected"},{"version":"f21293549f60f88c74fcb9944737f11048896dc4","lessThan":"01cc395cecfaa73134d39fb9a401d9605d8bb2c5","versionType":"git","status":"affected"},{"version":"f21293549f60f88c74fcb9944737f11048896dc4","lessThan":"a2f5286ca4f304d3fd469f01b96b518608912a5c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/wext-sme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","lessThan":"2.6.32","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/01cc395cecfaa73134d39fb9a401d9605d8bb2c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/269498ce6c1e2132b072aa0c8660404926008f03","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/685082f4be77f4657b498ebbe9f942ef65c492cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b921a8993469a3482e0c67b5ce5cb6ce93f5f61","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a2f5286ca4f304d3fd469f01b96b518608912a5c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c970879e03b23a27df42caf7ba506485a165fb96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d01f1600e8b075aa17adb751ac9881bb6ee40dcc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93785","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.130","lastModified":"2026-10-03T11:17:48.050","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: validate idmap key payload length\n\nThe cifs.idmap key type stores its payload length in key->datalen, which\nis limited to U16_MAX.  Accepting a larger key payload truncates the\nrecorded length and can make later users interpret the payload using\ninconsistent bounds.\n\nReject oversized preparsed payloads before allocating or copying them.\nThis keeps key->datalen consistent with the stored data for both inline\nand separately allocated idmap payloads."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"eeac976b74b4f697cfc517187b7cbfd72652dbbc","versionType":"git","status":"affected"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"125b05ac8ca8758950e4369c1542d57a162f504c","versionType":"git","status":"affected"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"945f6cde6bcf8f08f6fa5df8882b1b9582e55efa","versionType":"git","status":"affected"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"3a4a34a732e8a08309eed0a74314dbd9f2f1c972","versionType":"git","status":"affected"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"6cfeef221ac00d63c07f6122f58e6159bde69ca0","versionType":"git","status":"affected"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"8b12f65d7caf16d124098cb4895a203367d35b57","versionType":"git","status":"affected"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"455488cd5054bcc59db40fa1cc2c004031a5b2a5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/125b05ac8ca8758950e4369c1542d57a162f504c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3a4a34a732e8a08309eed0a74314dbd9f2f1c972","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/455488cd5054bcc59db40fa1cc2c004031a5b2a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6cfeef221ac00d63c07f6122f58e6159bde69ca0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b12f65d7caf16d124098cb4895a203367d35b57","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/945f6cde6bcf8f08f6fa5df8882b1b9582e55efa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eeac976b74b4f697cfc517187b7cbfd72652dbbc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93786","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.243","lastModified":"2026-10-03T11:17:48.163","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: preserve VFS inherited POSIX ACL mask\n\nThe VFS initializes a child's POSIX ACL from the parent's default ACL and\nthe requested creation mode. Do not mutate the parent ACL or overwrite the\nchild's VFS-computed access and default ACLs afterwards.\n\nThis preserves restrictive ACL_MASK entries and prevents SMB object creation\nfrom widening effective permissions."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"4a19bb1c45667f5a5f6eff9cf6648e0f692d046f","versionType":"git","status":"affected"},{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"591acf171644de590cda245fd8595b473a1beb70","versionType":"git","status":"affected"},{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"0093909becbda22b62b39b654dbc607faed59cd0","versionType":"git","status":"affected"},{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"e148e567a9252643baa125cb65d7ae9c2c6cf68a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/0093909becbda22b62b39b654dbc607faed59cd0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a19bb1c45667f5a5f6eff9cf6648e0f692d046f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/591acf171644de590cda245fd8595b473a1beb70","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e148e567a9252643baa125cb65d7ae9c2c6cf68a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93787","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.363","lastModified":"2026-10-03T11:17:48.293","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: bound dirent name against end of SMB response in cifs_filldir\n\ncifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST /\nFIND_NEXT response using a length (de.namelen) supplied by the server.\nThe kmalloc'd SMB response buffer is bounded, but nothing checks that\nde.name + de.namelen still lies inside that buffer before the eventual\nfilldir64() -> verify_dirent_name() -> memchr() reads namelen bytes.\n\nA hostile SMB1 server that returns an oversized FileNameLength in a\ndirectory entry therefore causes memchr() to read past the end of the\nresponse slab buffer. Reachable from any user who can list a directory\non a CIFS mount served by an attacker-controlled server (getdents64()\non the mounted directory):\n\n  BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80\n  Read of size 1 at addr ffff88800e0640cc by task poc/115\n  Call Trace:\n   dump_stack_lvl+0x64/0x80\n   print_report+0xce/0x620\n   kasan_report+0xec/0x120\n   memchr+0x71/0x80\n   filldir64+0x4c/0x6a0\n   cifs_filldir.constprop.0+0x9bb/0x1e00\n   cifs_readdir+0x2101/0x3380\n   iterate_dir+0x19c/0x520\n   __x64_sys_getdents64+0x126/0x210\n   do_syscall_64+0x107/0x5a0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nPass the end-of-response pointer down to cifs_filldir() and reject\nentries whose name would extend past that boundary.\n\nThis bug was discovered by Artiphishell's vTriage pipeline, which\ngenerated a userspace reproducer (an emulated hostile SMB1 server plus\na getdents64() client) that reliably triggers the KASAN report on an\nunpatched kernel. The fix below was drafted with the Claude coding\nassistant; a userspace reproducer is available on request."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/readdir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4cb3d79beee0fecc739ce07af915d503f29ae557","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"cf87ef1e62ed31a439064cef69d6eec38c68bd92","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6e3b965267b7313903baba2739992b1e2e92d540","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"03003506c86f90312b0966283662c42fcab66e4b","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/readdir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/03003506c86f90312b0966283662c42fcab66e4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4cb3d79beee0fecc739ce07af915d503f29ae557","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e3b965267b7313903baba2739992b1e2e92d540","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf87ef1e62ed31a439064cef69d6eec38c68bd92","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93788","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.477","lastModified":"2026-10-03T11:17:48.457","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: acpi: validate WGDS table revision index\n\nCheck tbl_rev bounds before BIT(tbl_rev) to avoid undefined shifts when\nfirmware reports an invalid revision value."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/fw/acpi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"97f8a3d1610b1f50013de1e632b007cbfd7459d8","lessThan":"4f2ec7a0b3ff148cb13e14cb26ac43523df8b9f5","versionType":"git","status":"affected"},{"version":"97f8a3d1610b1f50013de1e632b007cbfd7459d8","lessThan":"9096509e63ddd349eb075ec447d1a714e87e17a4","versionType":"git","status":"affected"},{"version":"97f8a3d1610b1f50013de1e632b007cbfd7459d8","lessThan":"2fc98ab6fe8acabd13eb09dc17426a33cf9f27f7","versionType":"git","status":"affected"},{"version":"97f8a3d1610b1f50013de1e632b007cbfd7459d8","lessThan":"346a558491241cbe8fef82b3d8f62d1a6b6bf61f","versionType":"git","status":"affected"},{"version":"97f8a3d1610b1f50013de1e632b007cbfd7459d8","lessThan":"954e821f42aaca56073ca830c5fd4bcf1a89048c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/fw/acpi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2fc98ab6fe8acabd13eb09dc17426a33cf9f27f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/346a558491241cbe8fef82b3d8f62d1a6b6bf61f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4f2ec7a0b3ff148cb13e14cb26ac43523df8b9f5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9096509e63ddd349eb075ec447d1a714e87e17a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/954e821f42aaca56073ca830c5fd4bcf1a89048c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93789","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.593","lastModified":"2026-10-03T11:17:48.563","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: bound aligned TLV advance in FW parser\n\nValidate ALIGN(tlv_len, 4) against remaining parser length before\nconsuming bytes from the firmware image.\n\nThis avoids length underflow on malformed TLVs."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/iwl-drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"dd7a2509b3a79b290730a9c6a784bf03fedabb9a","lessThan":"61da42fdd21d98ccb8f1ec5224659f3d09202cf4","versionType":"git","status":"affected"},{"version":"dd7a2509b3a79b290730a9c6a784bf03fedabb9a","lessThan":"8c332d45b736d41301b7e07f322785d821265dbc","versionType":"git","status":"affected"},{"version":"dd7a2509b3a79b290730a9c6a784bf03fedabb9a","lessThan":"ce709fcab5e1d4df6d4ba980736dc5908502a40f","versionType":"git","status":"affected"},{"version":"dd7a2509b3a79b290730a9c6a784bf03fedabb9a","lessThan":"4cfadb2e01566bc36d42922fbe18838345087050","versionType":"git","status":"affected"},{"version":"dd7a2509b3a79b290730a9c6a784bf03fedabb9a","lessThan":"528fa9eb14c209533ca26958b76da55e0ce239d8","versionType":"git","status":"affected"},{"version":"dd7a2509b3a79b290730a9c6a784bf03fedabb9a","lessThan":"7aa9097623afb694bc25382a62e14d8e82bf002f","versionType":"git","status":"affected"},{"version":"dd7a2509b3a79b290730a9c6a784bf03fedabb9a","lessThan":"acad742714bdc70e7fd7f234323807c596828213","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/iwl-drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.35","status":"affected"},{"version":"0","lessThan":"2.6.35","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4cfadb2e01566bc36d42922fbe18838345087050","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/528fa9eb14c209533ca26958b76da55e0ce239d8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61da42fdd21d98ccb8f1ec5224659f3d09202cf4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7aa9097623afb694bc25382a62e14d8e82bf002f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c332d45b736d41301b7e07f322785d821265dbc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/acad742714bdc70e7fd7f234323807c596828213","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce709fcab5e1d4df6d4ba980736dc5908502a40f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93790","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.710","lastModified":"2026-10-03T11:17:48.677","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif\n\nmvmsta->tid_data was indexed by the TFD loop counter 'i' instead of\nthe actual TID value 'tid'. This writes lq_color into a random tid_data\nslot unrelated to the BA entry.\nSince multi-TID blockack is not really in use, 'i' was always 0 and no\nharm was done.\nAdd a out-of-bound check before accessing the array."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"41fd2fec56db2564f02532ed7244e1f69193b4ad","lessThan":"35f991d685feafd27255bd33272512c434e52527","versionType":"git","status":"affected"},{"version":"41fd2fec56db2564f02532ed7244e1f69193b4ad","lessThan":"c48b741277b01b2c3b4ecccedc72fc575b71dc04","versionType":"git","status":"affected"},{"version":"41fd2fec56db2564f02532ed7244e1f69193b4ad","lessThan":"e8ac5e91b1296f65c3d119fac3fa917ff458f811","versionType":"git","status":"affected"},{"version":"41fd2fec56db2564f02532ed7244e1f69193b4ad","lessThan":"94d3982806c7f194b23484befde12934dda23064","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.15","status":"affected"},{"version":"0","lessThan":"4.15","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/35f991d685feafd27255bd33272512c434e52527","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94d3982806c7f194b23484befde12934dda23064","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c48b741277b01b2c3b4ecccedc72fc575b71dc04","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8ac5e91b1296f65c3d119fac3fa917ff458f811","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93791","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.820","lastModified":"2026-10-03T11:17:48.800","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: add a check on the tid coming from the firmware\n\nba_notif->tid is a firmware-controlled u8 that is used directly\nas an array index into tid_data[] without any validation. Add a\nbounds check against IWL_MAX_TID_COUNT before dereferencing the\narray."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c46e7724bfe9bbff17bc468903a757248b99e4ed","lessThan":"0f690fd3b5535d110898b99ae6214f29c9060941","versionType":"git","status":"affected"},{"version":"c46e7724bfe9bbff17bc468903a757248b99e4ed","lessThan":"0b5325a0771674f1d65618de7db3df9d49186a12","versionType":"git","status":"affected"},{"version":"c46e7724bfe9bbff17bc468903a757248b99e4ed","lessThan":"59f64c2839022f41a7867b38f9e38c185ff39283","versionType":"git","status":"affected"},{"version":"c46e7724bfe9bbff17bc468903a757248b99e4ed","lessThan":"0e4c0d83267261cf67ec9690856edf4a56bb7dfc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0b5325a0771674f1d65618de7db3df9d49186a12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0e4c0d83267261cf67ec9690856edf4a56bb7dfc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0f690fd3b5535d110898b99ae6214f29c9060941","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59f64c2839022f41a7867b38f9e38c185ff39283","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93792","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.933","lastModified":"2026-10-03T11:17:48.900","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix a possible underflow\n\nWe shouldn't trust the firmware about the length of the wowlan packet."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/d3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f444eb10d537c776ce82fbcd07733d75f45346f1","lessThan":"3ea815f401652003c2eec3b8969f74526f1342f0","versionType":"git","status":"affected"},{"version":"f444eb10d537c776ce82fbcd07733d75f45346f1","lessThan":"38ad8339211bf24c19126ec7629ea52094676454","versionType":"git","status":"affected"},{"version":"f444eb10d537c776ce82fbcd07733d75f45346f1","lessThan":"83f32942a501c80f44b8a8f668bc8b56d5d0d43f","versionType":"git","status":"affected"},{"version":"f444eb10d537c776ce82fbcd07733d75f45346f1","lessThan":"0cb5260a1027a43f8cdb961e128f2ddd42e46832","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/d3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.9","status":"affected"},{"version":"0","lessThan":"3.9","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0cb5260a1027a43f8cdb961e128f2ddd42e46832","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38ad8339211bf24c19126ec7629ea52094676454","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3ea815f401652003c2eec3b8969f74526f1342f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83f32942a501c80f44b8a8f668bc8b56d5d0d43f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93793","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.050","lastModified":"2026-10-21T13:21:07.833","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: validate TX_CMD response layout\n\nTX_CMD parsing uses frame_count to walk status entries and then\nread the trailing SCD SSN. Make the minimum-length check follow\nthat exact runtime layout calculation before parsing the payload.\n\nFor new TX API, reject TX_CMD responses with frame_count != 1 and\nwarn/return in the aggregation handler to document that aggregated\naccounting is expected via BA notifications."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c","lessThan":"5e871c03506c529d5fe372d099c1ad1465c7bc38","versionType":"git","status":"affected"},{"version":"8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c","lessThan":"fc14f5fe8a4374ed1088cfbddc1dae4d16c9935b","versionType":"git","status":"affected"},{"version":"8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c","lessThan":"4d942dfc13aec393e003ab28ff58db744c26e6eb","versionType":"git","status":"affected"},{"version":"8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c","lessThan":"8d70881707b47353359df57df12f6de67fdacdd2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.9","status":"affected"},{"version":"0","lessThan":"3.9","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/4d942dfc13aec393e003ab28ff58db744c26e6eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5e871c03506c529d5fe372d099c1ad1465c7bc38","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8d70881707b47353359df57df12f6de67fdacdd2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc14f5fe8a4374ed1088cfbddc1dae4d16c9935b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93794","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.160","lastModified":"2026-10-03T11:17:49.000","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: flush dirty data before punching a hole\n\nPunching a hole after a large buffered write may leave the range\nreported as data. Reproduce it with:\n\n  xfs_io -f \\\n    -c \"pwrite -b 3m -S 0x61 0 3m\" \\\n    -c \"fpunch 1m 1m\" \\\n    -c \"seek -h 0\" \\\n    -c \"seek -d 1m\" \\\n    /mnt/test/repro\n\nPunching 1 MiB at offset 1 MiB should produce:\n\n  0          1 MiB       2 MiB       3 MiB\n  |  DATA    |   HOLE    |   DATA    | EOF\n\nInstead, the entire file is reported as data. SEEK_HOLE(0) returns EOF,\nand SEEK_DATA(1M) returns 1M.\n\nThis happens because a dirty folio spanning the punched range can be\nwritten back after the punch and refill the hole.\n\nFix this by flushing and waiting for dirty data in the punched range\nbefore invalidating the page cache and issuing FSCTL_SET_ZERO_DATA.\n\nThe xfstests generic/539 pass against Samba/ksmbd with this change."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"31742c5a331766bc7df6b0d525df00c6cd20d5a6","lessThan":"216e469586057c29409e4ef8311d282388c6e251","versionType":"git","status":"affected"},{"version":"31742c5a331766bc7df6b0d525df00c6cd20d5a6","lessThan":"6c265aca08155e519a8f6f6071c59dff4f535f70","versionType":"git","status":"affected"},{"version":"31742c5a331766bc7df6b0d525df00c6cd20d5a6","lessThan":"39562a56cdb515f6635c3e7bfe6629439b18a169","versionType":"git","status":"affected"},{"version":"31742c5a331766bc7df6b0d525df00c6cd20d5a6","lessThan":"d7d2adcd022baade5cab65ca492ce63421ce3a6e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.17","status":"affected"},{"version":"0","lessThan":"3.17","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/216e469586057c29409e4ef8311d282388c6e251","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/39562a56cdb515f6635c3e7bfe6629439b18a169","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6c265aca08155e519a8f6f6071c59dff4f535f70","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7d2adcd022baade5cab65ca492ce63421ce3a6e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93795","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.270","lastModified":"2026-10-03T11:17:49.107","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix leaks and online flag on radix_tree_insert failure\n\nWhen radix_tree_insert() fails in blkg_create(), the error path has two\nissues:\n\n1. blkg->online is set to true unconditionally, even when the blkg was\n   never fully inserted.  Move the assignment inside the success block.\n\n2. The error path calls blkg_put() without first calling\n   percpu_ref_kill().  Because the refcount is still in percpu mode,\n   percpu_ref_put() only does this_cpu_sub() without checking for zero,\n   so blkg_release() is never triggered.  This permanently leaks the\n   blkg memory, its percpu iostat, policy data, the parent blkg\n   reference, and the cgroup css reference — the latter preventing the\n   cgroup from ever being destroyed.\n\nFix by replacing blkg_put() with percpu_ref_kill(), matching the pattern\nused in blkg_destroy()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["block/blk-cgroup.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7fcf2b033b84e261dca283bc2911aaea4b07b525","lessThan":"0f840db042caee9d2f3dcdcf97d6674f6e4c1e30","versionType":"git","status":"affected"},{"version":"7fcf2b033b84e261dca283bc2911aaea4b07b525","lessThan":"f53945d7c712efe63fadbcc5ffed6370871fd0d3","versionType":"git","status":"affected"},{"version":"7fcf2b033b84e261dca283bc2911aaea4b07b525","lessThan":"ada8270ccdb6f212da5eb22614c28ea418746a4a","versionType":"git","status":"affected"},{"version":"7fcf2b033b84e261dca283bc2911aaea4b07b525","lessThan":"c3650be82ef6e7af13b79b2d10a7363bdf54aa7f","versionType":"git","status":"affected"},{"version":"7fcf2b033b84e261dca283bc2911aaea4b07b525","lessThan":"6e85f02d45b5977c0326a8d854c6db878aa6b34a","versionType":"git","status":"affected"},{"version":"7fcf2b033b84e261dca283bc2911aaea4b07b525","lessThan":"4c0d150fb98ea40760611979f4e664c244b20966","versionType":"git","status":"affected"},{"version":"7fcf2b033b84e261dca283bc2911aaea4b07b525","lessThan":"dbbca20764382b4d411ec2918f4e278ffe547acc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["block/blk-cgroup.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0f840db042caee9d2f3dcdcf97d6674f6e4c1e30","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c0d150fb98ea40760611979f4e664c244b20966","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e85f02d45b5977c0326a8d854c6db878aa6b34a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ada8270ccdb6f212da5eb22614c28ea418746a4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3650be82ef6e7af13b79b2d10a7363bdf54aa7f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dbbca20764382b4d411ec2918f4e278ffe547acc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f53945d7c712efe63fadbcc5ffed6370871fd0d3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93796","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.383","lastModified":"2026-10-21T13:21:07.997","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: pcie: null RX pointers after free\n\nWhen iwl_pcie_tx_init() fails after RX init, nic init unwinds via\niwl_pcie_rx_free().\n\nThe freed RX members stayed non-NULL on the live transport object,\nso later teardown or retry could touch stale RX state.\nSet rx_pool, global_table, rxq, and alloc_page to NULL after free\nto make repeated cleanup and retry paths safe."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9cf671d60fdbeb8f875859c11148cf13c326ada2","lessThan":"c422d5d53f135ea987f745773953a91f9fe30c3f","versionType":"git","status":"affected"},{"version":"9cf671d60fdbeb8f875859c11148cf13c326ada2","lessThan":"6ec5bf430cf7466cb412e47f2761594092781fac","versionType":"git","status":"affected"},{"version":"9cf671d60fdbeb8f875859c11148cf13c326ada2","lessThan":"3456c5bcc987aeb182e50e30c9b02be8420e9953","versionType":"git","status":"affected"},{"version":"9cf671d60fdbeb8f875859c11148cf13c326ada2","lessThan":"2c79d7a7b583050c9f58041465cb46fe3483ab5d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2c79d7a7b583050c9f58041465cb46fe3483ab5d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3456c5bcc987aeb182e50e30c9b02be8420e9953","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ec5bf430cf7466cb412e47f2761594092781fac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c422d5d53f135ea987f745773953a91f9fe30c3f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93797","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.500","lastModified":"2026-10-03T11:17:49.227","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix an off-by-1 boundary check\n\nBefore looking at the 11th byte, check the length is big enough."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4f58121dc40a1d5dd2f630a5ec4dac5afa1ce3f4","lessThan":"2c8c06c59ed72a42e4d32e222542b582b4911459","versionType":"git","status":"affected"},{"version":"4f58121dc40a1d5dd2f630a5ec4dac5afa1ce3f4","lessThan":"23d3fddddd2bcedb4fd6cec5bef16b1fbb563019","versionType":"git","status":"affected"},{"version":"4f58121dc40a1d5dd2f630a5ec4dac5afa1ce3f4","lessThan":"45fcdbae679861b90f08964a0c3e9eead3bacd6f","versionType":"git","status":"affected"},{"version":"4f58121dc40a1d5dd2f630a5ec4dac5afa1ce3f4","lessThan":"7a2d4efea2c41b49db90907c8b6f37f8b63a9f50","versionType":"git","status":"affected"},{"version":"4f58121dc40a1d5dd2f630a5ec4dac5afa1ce3f4","lessThan":"1e3b72c9b63288a5f204e2c8f38eae01515d7dc5","versionType":"git","status":"affected"},{"version":"4f58121dc40a1d5dd2f630a5ec4dac5afa1ce3f4","lessThan":"4d60332387336088e66cc8f1e71e516b6b872ef9","versionType":"git","status":"affected"},{"version":"4f58121dc40a1d5dd2f630a5ec4dac5afa1ce3f4","lessThan":"d77aff138c9ec6c8562f4c2c9f262d3d9c4b4cb8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1e3b72c9b63288a5f204e2c8f38eae01515d7dc5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/23d3fddddd2bcedb4fd6cec5bef16b1fbb563019","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c8c06c59ed72a42e4d32e222542b582b4911459","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/45fcdbae679861b90f08964a0c3e9eead3bacd6f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4d60332387336088e66cc8f1e71e516b6b872ef9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a2d4efea2c41b49db90907c8b6f37f8b63a9f50","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d77aff138c9ec6c8562f4c2c9f262d3d9c4b4cb8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93798","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.607","lastModified":"2026-10-03T11:17:49.337","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix reloc root cleanup in merge_reloc_roots()\n\nIf the root we got has zero root refs in its root item, we are resetting\nthe root's ->reloc_root without using barriers like we do everywhere else.\nSashiko complained about this while reviewing another patch, and it's\ncorrect (see the Link tag below).\n\nAlso, we should not clear BTRFS_ROOT_DEAD_RELOC_TREE from the root unless\nthe root points to the reloc root we have.\n\nFix this by using clear_reloc_root(), which issues the memory barrier\nafter setting the root's ->reloc_root to NULL and before clearing the bit\nBTRFS_ROOT_DEAD_RELOC_TREE from the root."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/relocation.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1dae7e0e58b484eaa43d530f211098fdeeb0f404","lessThan":"29531470b1bf1e8bd2df4941fe913106edbca615","versionType":"git","status":"affected"},{"version":"1dae7e0e58b484eaa43d530f211098fdeeb0f404","lessThan":"415f8665a969d3c906e4fd7c90fcbb4b357886f6","versionType":"git","status":"affected"},{"version":"1dae7e0e58b484eaa43d530f211098fdeeb0f404","lessThan":"ee695a968aa73b1e67ccbf2133dc0e54381d32b2","versionType":"git","status":"affected"},{"version":"1dae7e0e58b484eaa43d530f211098fdeeb0f404","lessThan":"0bc25f0a2d1b3e0a691431c4d7aef36afcd527c5","versionType":"git","status":"affected"},{"version":"1dae7e0e58b484eaa43d530f211098fdeeb0f404","lessThan":"ab48583aa9948205ff9a6470e23dbff74c565e24","versionType":"git","status":"affected"},{"version":"1dae7e0e58b484eaa43d530f211098fdeeb0f404","lessThan":"63d6b1f04cd91c825329712aa526215ffa5d11ca","versionType":"git","status":"affected"},{"version":"1dae7e0e58b484eaa43d530f211098fdeeb0f404","lessThan":"b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8","versionType":"git","status":"affected"},{"version":"ee08663380ffd5a45a1c87580fbc305e8413c235","versionType":"git","status":"affected"},{"version":"33823378ff2b510fd7b566f25bb18438aeb9b23b","versionType":"git","status":"affected"},{"version":"5.4.54","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.7.11","lessThan":"5.8","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/relocation.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0bc25f0a2d1b3e0a691431c4d7aef36afcd527c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29531470b1bf1e8bd2df4941fe913106edbca615","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/415f8665a969d3c906e4fd7c90fcbb4b357886f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/63d6b1f04cd91c825329712aa526215ffa5d11ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab48583aa9948205ff9a6470e23dbff74c565e24","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee695a968aa73b1e67ccbf2133dc0e54381d32b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93799","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.720","lastModified":"2026-10-03T11:17:49.483","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: validate sta_id in BA window status notif\n\nBA_WINDOW_STATUS_NOTIFICATION_ID extracts a 5-bit sta_id from the\nfirmware notification and uses it to index fw_id_to_mac_id[] without\nbounds checking. Validate sta_id before array access to prevent\nout-of-bounds indexing."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3af512d6aac7eb6420086f124abb4426f5f4b369","lessThan":"f9938eb95e2ddab4a58d3946a320abcbd60b56a4","versionType":"git","status":"affected"},{"version":"3af512d6aac7eb6420086f124abb4426f5f4b369","lessThan":"bb08fbbbd5568d33069485ecb0a1657f115a4e9f","versionType":"git","status":"affected"},{"version":"3af512d6aac7eb6420086f124abb4426f5f4b369","lessThan":"e35ae757c6462bfd3437bf58121bb721fe1f790c","versionType":"git","status":"affected"},{"version":"3af512d6aac7eb6420086f124abb4426f5f4b369","lessThan":"6aa77efaea9efea92e3090c35ad348fd759a3cf3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.6","status":"affected"},{"version":"0","lessThan":"4.6","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/6aa77efaea9efea92e3090c35ad348fd759a3cf3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb08fbbbd5568d33069485ecb0a1657f115a4e9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e35ae757c6462bfd3437bf58121bb721fe1f790c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f9938eb95e2ddab4a58d3946a320abcbd60b56a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93800","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.870","lastModified":"2026-10-03T11:17:49.673","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()\n\nIf during relocation we fail in insert_dirty_subvol() because\nbtrfs_update_reloc_root() returned an error, we will leave a root's\nreloc_root field pointing to a reloc root that was freed instead of NULL,\nresulting later in a use-after-free, or double free attempt during\nunmount.\n\nThe sequence of steps is this:\n\n1) During relocation the call to btrfs_update_reloc_root() in\n   insert_dirty_subvol() fails, so insert_dirty_subvol() returns the\n   error to merge_reloc_root() without adding the root to the list\n   rc->dirty_subvol_roots;\n\n2) Then merge_reloc_root() aborts the current transaction because\n   insert_dirty_subvol() returned an error;\n\n3) Up the call chain, merge_reloc_roots() gets the error, adds the\n   reloc root for root X to the local reloc_roots list and jumps to the\n   'out' label, where it calls free_reloc_roots() to free all the reloc\n   roots in the local reloc_roots list. This frees the reloc root for\n   root X;\n\n4) We go up the call chain to relocate_block_group() which calls\n   clean_dirty_subvols() to go over dirty roots and set their\n   ->reloc_root field to NULL, but root X is not in the dirty_subvol_roots\n   list, so its ->reloc_root still points to a reloc root;\n\n5) Relocation finishes, with an error and a transaction abort, but the\n   ->reloc_root field for root X still points to the reloc root that was\n   freed in step 3;\n\n6) When unmounting the fs we end up calling:\n\n     btrfs_free_fs_roots()\n        btrfs_drop_and_free_fs_root()\n           --> calls btrfs_put_root() against root X's ->reloc_root\n               which is not NULL and points to the already freed\n               reloc root in step 4 above\n\n  Resulting in a use-after-free to a double free attempt.\n\nSyzbot reported this with the following dmesg/syslog:\n\n   [  106.004389][ T5339] BTRFS error (device loop0 state A): Transaction aborted (error -5)\n   [  106.014266][ T5339] BTRFS: error (device loop0 state A) in merge_reloc_root:1655: errno=-5 IO failure\n   [  106.021891][ T1061] BTRFS error (device loop0 state A): error while writing out transaction: -5\n   [  106.026964][ T1061] BTRFS warning (device loop0 state A): Skipping commit of aborted transaction.\n   [  106.033807][ T5340] BTRFS error (device loop0 state A): bdev /dev/loop0 errs: wr 3, rd 0, flush 0, corrupt 0, gen 0\n   [  106.039265][ T1061] BTRFS: error (device loop0 state A) in cleanup_transaction:2067: errno=-5 IO failure\n   [  106.044382][ T5339] BTRFS info (device loop0 state EA): forced readonly\n   [  106.074329][ T5339] BTRFS: error (device loop0 state EA) in merge_reloc_roots:1887: errno=-5 IO failure\n   [  106.081004][ T5356] BTRFS info (device loop0 state EA): scrub: started on devid 1\n   [  106.085611][ T5339] BTRFS info (device loop0 state EA): balance: ended with status: -30\n   [  106.089517][ T5356] BTRFS info (device loop0 state EA): scrub: not finished on devid 1 with status: -30\n   [  106.662365][ T5338] BTRFS info (device loop0 state EA): last unmount of filesystem 3a375e4e-b156-4d76-a2ad-16e198ce1409\n   [  106.682946][ T5338] ==================================================================\n   [  106.686574][ T5338] BUG: KASAN: slab-use-after-free in btrfs_put_root+0x2f/0x250\n   [  106.690090][ T5338] Write of size 4 at addr ffff88803f978630 by task syz.0.0/5338\n   [  106.693173][ T5338]\n   [  106.694279][ T5338] CPU: 0 UID: 0 PID: 5338 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)\n   [  106.694293][ T5338] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n   [  106.694300][ T5338] Call Trace:\n   [  106.694308][ T5338]  <TASK>\n   [  106.694314][ T5338]  dump_stack_lvl+0xe8/0x150\n   [  106.694331][ T5338]  print_address_description+0x55/0x1e0\n   [  106.694343][ T5338]  ? btrfs_put_root+0x2f/0x250\n   [  106.694358][ T5338]  print_report+0x58/0x70\n   [  106.\n---truncated---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/relocation.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f32b84d7c977e1906a4781b93b3c93090b6cd675","lessThan":"5a247097c5f94b51ffc991b444d998ad6e85875f","versionType":"git","status":"affected"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"6372dd394ea907cd85a7a8063db320ec73dfaed0","versionType":"git","status":"affected"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"9f599d120b2b79d2d937c3935b7cdf2697514283","versionType":"git","status":"affected"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"a01837ae174a2a968c245a30e6dd010f50eaf05d","versionType":"git","status":"affected"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"97a540d72ebcb21853d11f2a56782fe377f358e7","versionType":"git","status":"affected"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"fda1b6636ff1846f00643e791099db5564b547d9","versionType":"git","status":"affected"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"83201804efa4a5168be754e1dfc9b2faee760cac","versionType":"git","status":"affected"},{"version":"aa18bc1ff8a51f082d5b3b6d07693797637b4028","versionType":"git","status":"affected"},{"version":"4cb0aea2e250eee35ccfac5f5395cd8f3238a9e5","versionType":"git","status":"affected"},{"version":"5.10.36","lessThan":"5.10.271","versionType":"semver","status":"affected"},{"version":"5.11.20","lessThan":"5.12","versionType":"semver","status":"affected"},{"version":"5.12.3","lessThan":"5.13","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/relocation.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5a247097c5f94b51ffc991b444d998ad6e85875f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6372dd394ea907cd85a7a8063db320ec73dfaed0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83201804efa4a5168be754e1dfc9b2faee760cac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97a540d72ebcb21853d11f2a56782fe377f358e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f599d120b2b79d2d937c3935b7cdf2697514283","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a01837ae174a2a968c245a30e6dd010f50eaf05d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fda1b6636ff1846f00643e791099db5564b547d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93801","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.017","lastModified":"2026-10-21T13:21:08.140","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: zero-initialize stack-allocated cifs_open_info_data\n\nStack-allocated cifs_open_info_data may contain random data.\nThis can make some fields have wrong value if they are not set later."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/link.c","fs/smb/client/smb1ops.c","fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"436cfdbc57d98808fce427d9a8d97691374989b3","lessThan":"2c5db82778f560121efda9e052e2f19c2d807c1b","versionType":"git","status":"affected"},{"version":"fc2f2011d3d84b56f536b4a25a4bb2fa1b13d520","lessThan":"74ff47e6c4213fcfeba2de448d9cbda200507d22","versionType":"git","status":"affected"},{"version":"057ac50638bcece64b3b436d3a61b70ed6c01a34","lessThan":"22532dd88694ed20bdd47523ffa709f166ce776b","versionType":"git","status":"affected"},{"version":"057ac50638bcece64b3b436d3a61b70ed6c01a34","lessThan":"8fce4cf4369c766a3293a05419500cbfde72e60d","versionType":"git","status":"affected"},{"version":"83d3bc866530a36a465b47cce4d2a9def2411960","versionType":"git","status":"affected"},{"version":"6.6.113","lessThan":"6.6.160","versionType":"semver","status":"affected"},{"version":"6.12.54","lessThan":"6.12.111","versionType":"semver","status":"affected"},{"version":"6.17.4","lessThan":"6.18","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/link.c","fs/smb/client/smb1ops.c","fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/22532dd88694ed20bdd47523ffa709f166ce776b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c5db82778f560121efda9e052e2f19c2d807c1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74ff47e6c4213fcfeba2de448d9cbda200507d22","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8fce4cf4369c766a3293a05419500cbfde72e60d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93802","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.127","lastModified":"2026-10-03T11:17:49.843","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rsi: validate beacon length before fixed buffer copy\n\nrsi_prepare_beacon() copies the mac80211 beacon frame after\nFRAME_DESC_SZ into a management skb whose usable tailroom may be smaller\nthan MAX_MGMT_PKT_SIZE after alignment.\n\nValidate the beacon length against the actual tailroom before the copy\nand skb_put(). Leave ownership of the management skb with the caller on\nerror, matching the existing rsi_send_beacon() cleanup path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/rsi/rsi_91x_hal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d26a9559403c7c3ec3b430f5825bc22c3d40abdb","lessThan":"795ba65f46fe44061f1195951c122cc8ec685d44","versionType":"git","status":"affected"},{"version":"d26a9559403c7c3ec3b430f5825bc22c3d40abdb","lessThan":"66a964432b2758a4cf69962366e37581d6e70632","versionType":"git","status":"affected"},{"version":"d26a9559403c7c3ec3b430f5825bc22c3d40abdb","lessThan":"7f99742c3c2801f8033d8b7a0a58254d7f24fb1e","versionType":"git","status":"affected"},{"version":"d26a9559403c7c3ec3b430f5825bc22c3d40abdb","lessThan":"f08d7f3c916335a0e539f1c45c130615967fac47","versionType":"git","status":"affected"},{"version":"d26a9559403c7c3ec3b430f5825bc22c3d40abdb","lessThan":"87710ad633ce4588aec88611d0d0745eb33a6991","versionType":"git","status":"affected"},{"version":"d26a9559403c7c3ec3b430f5825bc22c3d40abdb","lessThan":"266f195d5a14eec6c482fd09fbc924584c3371a7","versionType":"git","status":"affected"},{"version":"d26a9559403c7c3ec3b430f5825bc22c3d40abdb","lessThan":"8ecdeb8b8a33b22c597299043c0dcfce50beb9ea","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/rsi/rsi_91x_hal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/266f195d5a14eec6c482fd09fbc924584c3371a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/66a964432b2758a4cf69962366e37581d6e70632","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/795ba65f46fe44061f1195951c122cc8ec685d44","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f99742c3c2801f8033d8b7a0a58254d7f24fb1e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87710ad633ce4588aec88611d0d0745eb33a6991","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8ecdeb8b8a33b22c597299043c0dcfce50beb9ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f08d7f3c916335a0e539f1c45c130615967fac47","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93803","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.240","lastModified":"2026-10-03T11:17:50.060","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libipw: fix key index receive bound checks\n\nlibipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index in\nboth the software-decrypt key selection path and the hardware-decrypted\nIV/ICV strip path. In both places the existing guard only checks\nskb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the\nbyte at hdrlen + 3.\n\nRequire hdrlen + 4 bytes before reading that item in both paths. This is\na local source-boundary check only; it does not change the key index\nsemantics."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/ipw2x00/libipw_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"bb18262c19feb690ddde58c70e3ad04bc6fe566e","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"09d4a1bc3a08bb0e19bdf250b9f575cfef0bae82","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"2836a870f612a8a6d9e390d00fa2cf6c90aa5808","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"0b61c465ea62063593bc9ac186871b69e58ae991","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"062840bdc9ee06169b3c371bf66711f1d7ec0bf4","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"c54b643e9a0936d038921c547736574fd7382cea","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"74ed3669f26803b1761c1f55403062bea44c3466","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/ipw2x00/libipw_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.14","status":"affected"},{"version":"0","lessThan":"2.6.14","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/062840bdc9ee06169b3c371bf66711f1d7ec0bf4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/09d4a1bc3a08bb0e19bdf250b9f575cfef0bae82","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0b61c465ea62063593bc9ac186871b69e58ae991","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2836a870f612a8a6d9e390d00fa2cf6c90aa5808","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74ed3669f26803b1761c1f55403062bea44c3466","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb18262c19feb690ddde58c70e3ad04bc6fe566e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c54b643e9a0936d038921c547736574fd7382cea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93804","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.350","lastModified":"2026-10-21T13:21:08.277","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: ibss: wait for in-flight TX on disconnect\n\nWhile leaving an IBSS in ieee80211_ibss_disconnect() mac80211 flushes\nstations, turns the carrier off and immediately tells the driver to\nleave as well. While there may be synchronize_net() in station flush\nand in this code later, packets can still be transmitted due to\ncross-CPU race conditions after carrier off is set.\nTherefore, it's possible for a race to happen where a TX to the\ndriver occurs while or after telling it to leave the IBSS. This can\nbe confusing to drivers, and in the case of iwlwifi leads to an\nattempt to use invalid queues.\n\nMove netif_carrier_off() to occur before sta_info_flush() during\nIBSS disconnect, and add synchronize_net() if flushing didn't,\nso that the synchronize_net() always happens between turning the\ncarrier off and telling the driver, avoiding this race."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/ibss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"86a2ea4134b48f6371103cfceb521bf2d2bf76cd","lessThan":"8e4a07ed82bae5d13525770880dc6dfd27f9bccd","versionType":"git","status":"affected"},{"version":"86a2ea4134b48f6371103cfceb521bf2d2bf76cd","lessThan":"20a3fb5e1a95caa34896853ca17a50d21c754969","versionType":"git","status":"affected"},{"version":"86a2ea4134b48f6371103cfceb521bf2d2bf76cd","lessThan":"b3451e6971248250312ad32dd7f63cc9f0a925f5","versionType":"git","status":"affected"},{"version":"86a2ea4134b48f6371103cfceb521bf2d2bf76cd","lessThan":"d0e69d9afa59b93c30294eba89b1f15f69e91105","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/ibss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.3","status":"affected"},{"version":"0","lessThan":"3.3","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/20a3fb5e1a95caa34896853ca17a50d21c754969","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e4a07ed82bae5d13525770880dc6dfd27f9bccd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b3451e6971248250312ad32dd7f63cc9f0a925f5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0e69d9afa59b93c30294eba89b1f15f69e91105","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93805","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.460","lastModified":"2026-10-03T11:17:50.190","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate rx/tx MLME callback frame lengths before access\n\ncfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() call tracepoints\nbefore rejecting frames shorter than the frame-control field. After\nthat, they only require len >= 2 before dispatching into subtype\nhandlers that assume their fixed fields are present.\n\nThe frames that trip this are not shorter than 2 bytes; they are short\nrelative to their subtype. mwifiex is a concrete in-tree example on the\nlength side: mwifiex_process_mgmt_packet() only requires a 4-address\nieee80211_hdr plus the 2-byte firmware length prefix before handing the\nframe to cfg80211_rx_mlme_mgmt(). After stripping the length prefix and\nremoving addr4, pkt_len can be exactly 24: a bare 3-address management\nheader with no reason-code body. The existing WARN_ON(len < 2) does not\nfire on such a frame, and cfg80211_process_deauth() then reads\nu.deauth.reason_code as a two-byte access starting at offset 24,\nimmediately past the 24-byte buffer.\n\nAdd a frame-control length gate, then validate each subtype's minimum\nframe size in an if/else-if chain that mirrors the dispatch logic. Trace\nonly after the frame is known to be well-formed.\n\nSide effects of this change:\n - The WARN_ON(len < 2) is dropped. It only guarded the frame_control\n   read, never the subtype fixed fields, and it does not fire on the\n   frames that actually trigger the out-of-bounds read (which are >= 2).\n   The len >= 2 check is kept as the guard before dereferencing\n   frame_control, but without the warning: these are exported callbacks\n   and a malformed frame from a driver should be dropped silently rather\n   than backtraced.\n - cfg80211_tx_mlme_mgmt() previously routed every non-deauth subtype\n   through disassociation handling; it now silently ignores unrecognised\n   subtypes."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/mlme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"6eb4bd50be53f5afbabb3a3b5153276e08fa7a4a","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"ce2a3be6909462f49c34de96be71f0ad5f0d573f","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"6bdf4dcff98df634e04ebf99f52027a48d7f78ff","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"0ec738a0d361d7eb37188117166d201f9df622d3","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"8f4127a93cf60d561ad39849a9ac763ba0e14db5","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"d5e4586546974179feca305a94e07fac3e9727fe","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/mlme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","lessThan":"2.6.32","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0ec738a0d361d7eb37188117166d201f9df622d3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6bdf4dcff98df634e04ebf99f52027a48d7f78ff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6eb4bd50be53f5afbabb3a3b5153276e08fa7a4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f4127a93cf60d561ad39849a9ac763ba0e14db5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce2a3be6909462f49c34de96be71f0ad5f0d573f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5e4586546974179feca305a94e07fac3e9727fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93806","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.570","lastModified":"2026-10-03T11:17:50.320","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate assoc response length before status and IE access\n\ncfg80211_rx_assoc_resp() initialises the status and response-IE fields\nof cfg80211_connect_resp_params from the management frame before\nproving that the frame is long enough for those offsets. S1G and\nregular association responses also have different IE offsets, but the\nS1G path only patched resp_ie after the unsafe initialiser had already\nrun.\n\nDefer resp_ie, resp_ie_len, and status to after the link-iteration\nloop. Use a bool to remember whether the frame is S1G, then validate\nthe appropriate minimum length and set all three fields in a single\nif/else block. Funnel short-frame and SME-reject cleanup through a\nshared free_bss label for the abandon paths."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/mlme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"3bcaaaa4ad334053ceea2ea2f0623f22afe2e1ac","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"71be658246c903b9e96976a23c23800675896a1b","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"a57310600c1e2b9ada0f37c96e8f48aef47d3093","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"78ac450ad4624d6b2999cb4eeb28916767f81247","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"b760113aeca2e9362d56bf9e9263373ffe6c8eb3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/mlme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","lessThan":"2.6.32","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3bcaaaa4ad334053ceea2ea2f0623f22afe2e1ac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/71be658246c903b9e96976a23c23800675896a1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78ac450ad4624d6b2999cb4eeb28916767f81247","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a57310600c1e2b9ada0f37c96e8f48aef47d3093","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b760113aeca2e9362d56bf9e9263373ffe6c8eb3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93807","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.683","lastModified":"2026-10-03T11:17:50.480","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers\n\nrsi_hal_load_key() copies tx_mic_key and rx_mic_key from data[16] and\ndata[24] whenever key data is present. Those offsets are only part of\nthe 32-byte TKIP key layout. Shorter keys used by other ciphers, such as\nCCMP, do not provide those bytes, so the unconditional copies can read\npast the supplied key buffer.\n\nOnly copy the MIC keys for TKIP, and reject malformed TKIP keys that are\nshorter than the expected 32-byte layout.\n\n[drop useless length check]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/rsi/rsi_91x_mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"dad0d04fa7ba41ce603a01e8e64967650303e9a2","lessThan":"6937b06d55b528e961feff8cc083b97ede622e02","versionType":"git","status":"affected"},{"version":"dad0d04fa7ba41ce603a01e8e64967650303e9a2","lessThan":"ebd7172f8c4edc232738ef50338fb773c6f6c208","versionType":"git","status":"affected"},{"version":"dad0d04fa7ba41ce603a01e8e64967650303e9a2","lessThan":"6b6690ac5c35e803df14afdc44312d11e8a60893","versionType":"git","status":"affected"},{"version":"dad0d04fa7ba41ce603a01e8e64967650303e9a2","lessThan":"5207727e53fba1e3a6fce9b2c15b6b8b06c6438b","versionType":"git","status":"affected"},{"version":"dad0d04fa7ba41ce603a01e8e64967650303e9a2","lessThan":"5902e3c08c63d65724772f74d65b9fb032625dca","versionType":"git","status":"affected"},{"version":"dad0d04fa7ba41ce603a01e8e64967650303e9a2","lessThan":"55b86ef6c2e68879ffd95203b011ef42a013ab88","versionType":"git","status":"affected"},{"version":"dad0d04fa7ba41ce603a01e8e64967650303e9a2","lessThan":"843fe9bc583b7686ca68312ac9319c9240a73c03","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/rsi/rsi_91x_mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.15","status":"affected"},{"version":"0","lessThan":"3.15","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5207727e53fba1e3a6fce9b2c15b6b8b06c6438b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55b86ef6c2e68879ffd95203b011ef42a013ab88","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5902e3c08c63d65724772f74d65b9fb032625dca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6937b06d55b528e961feff8cc083b97ede622e02","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b6690ac5c35e803df14afdc44312d11e8a60893","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/843fe9bc583b7686ca68312ac9319c9240a73c03","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ebd7172f8c4edc232738ef50338fb773c6f6c208","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93808","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.797","lastModified":"2026-10-03T11:17:50.603","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: caiaq: validate EP1 reply lengths\n\nusb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then\nreads command-specific fixed items from the same URB buffer. Several\npaths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that\nurb->actual_length contains those bytes.\n\nAdd per-command length checks, use a payload length derived from the\nbytes after the command byte for the control-state copy, and reject short\nanalog input payloads before the input helper reads fixed offsets from\nthe EP1 reply."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/caiaq/device.c","sound/usb/caiaq/input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"91acd231f219452fa58285239f83945accad9513","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"7cc6b3745a0cea697c8d0684b3094f220281a08d","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"add9328c91c195c494cd68a21b19e5e47a20d784","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"319393151367e6626affedcdd4f7b7b0286f4246","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"af8a172c4f71ac30d625f2966d2389a7fa872819","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"74f3c639f64fa5da4e1613149798b5089bce2807","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"aba30af07d4fe499b50209801eba9da8a815522f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/usb/caiaq/device.c","sound/usb/caiaq/input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.22","status":"affected"},{"version":"0","lessThan":"2.6.22","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/319393151367e6626affedcdd4f7b7b0286f4246","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74f3c639f64fa5da4e1613149798b5089bce2807","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cc6b3745a0cea697c8d0684b3094f220281a08d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91acd231f219452fa58285239f83945accad9513","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aba30af07d4fe499b50209801eba9da8a815522f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/add9328c91c195c494cd68a21b19e5e47a20d784","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af8a172c4f71ac30d625f2966d2389a7fa872819","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93809","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.917","lastModified":"2026-09-25T13:17:21.763","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: flush pending RCU callbacks on module unload\n\nCall rcu_barrier() in module exit to wait for outstanding call_rcu() callbacks\nbefore freeing module text, preventing late callback execution in freed memory.\n\nBUG: unable to handle page fault for address: ffffffffc1d59c40\nPGD 6a12067 P4D 6a12067 PUD 6a14067 PMD 13698b067 PTE 0\nOops: 0010 [#1] SMP NOPTI\nRIP: 0010:0xffffffffc1d59c40\nCode: Unable to access opcode bytes at RIP 0xffffffffc1d59c16.\nRSP: 0018:ffffc900198c0f28 EFLAGS: 00010286\nRAX: ffffffffc1d59c40 RBX: ffff897c7d6b61c0 RCX: ffff88826aff4590\nRDX: ffff8884d8b35490 RSI: ffffc900198c0f30 RDI: ffff88812af67290\nRBP: 000000000000000a (DONE segment entries) R08: 0000000000000000 R09: 0000000000000100\nR10: 0000000000000000 R11: ffffffff82a06100 R12: ffff88811a4e3700\nR13: 0000000000000000 R14: ffff897c7d6b6270 R15: 0000000000000000\nFS:  0000000000000000(0000) GS:ffff897c7d680000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffc1d59c16 CR3: 00000104a980a001 CR4: 0000000002770ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n <IRQ>\n ? rcu_do_batch+0x163/0x450\n ? rcu_core+0x177/0x1c0\n ? __do_softirq+0xc1/0x280\n ? asm_call_irq_on_stack+0xf/0x20\n </IRQ>\n ? do_softirq_own_stack+0x37/0x50\n ? irq_exit_rcu+0xc4/0x100\n ? sysvec_apic_timer_interrupt+0x36/0x80\n ? asm_sysvec_apic_timer_interrupt+0x12/0x20\n ? cpuidle_enter_state+0xd4/0x360\n ? cpuidle_enter+0x29/0x40\n ? cpuidle_idle_call+0x108/0x1a0\n ? do_idle+0x77/0xf0\n ? cpu_startup_entry+0x19/0x20\n ? secondary_startup_64_no_verify+0xbf/0xcb\n\n(cherry picked from commit feaa5039f6c12acc9aa934c2d45dcd251a12c69f)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4e02e0afa95f691dc7cc17538cdd648089a843f0","lessThan":"67a654b41cfa73c3b83402c4a01b2689cad5b9bc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/67a654b41cfa73c3b83402c4a01b2689cad5b9bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93810","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:14.433","lastModified":"2026-10-03T11:17:50.733","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: Fix double fput\n\nFix a double fput() in error handling in cachefiles_create_tmpfile()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/cachefiles/namei.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"24a81759b65fa85767739999d91523691c5e2ea5","lessThan":"e582a3e99584d5a634a3cbce4b12e9381fd5d964","versionType":"git","status":"affected"},{"version":"24a81759b65fa85767739999d91523691c5e2ea5","lessThan":"246098a2b8e88761e92cf82c1be1ec576437b176","versionType":"git","status":"affected"},{"version":"24a81759b65fa85767739999d91523691c5e2ea5","lessThan":"e9c2e68c3890a935abbd5f54dbce653f9a16836c","versionType":"git","status":"affected"},{"version":"24a81759b65fa85767739999d91523691c5e2ea5","lessThan":"90b306eee037d0a6a8f4aac834b46e05c5ddd0bf","versionType":"git","status":"affected"},{"version":"24a81759b65fa85767739999d91523691c5e2ea5","lessThan":"af6830cc12dfe86c832dccc9c9878a93aaa22f83","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/cachefiles/namei.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/246098a2b8e88761e92cf82c1be1ec576437b176","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/90b306eee037d0a6a8f4aac834b46e05c5ddd0bf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af6830cc12dfe86c832dccc9c9878a93aaa22f83","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e582a3e99584d5a634a3cbce4b12e9381fd5d964","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9c2e68c3890a935abbd5f54dbce653f9a16836c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93811","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:14.550","lastModified":"2026-10-03T11:17:50.870","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling\n\n1. When ndr_decode_v4_ntacl() fails, the code jumped to free_n_data\n   which only freed n.data, skipping kfree(acl.sd_buf) and leaking\n   the buffer. Zero-initialize struct xattr_ntacl acl, reorder error\n   labels to out_free to release acl.sd_buf on all error paths.\n\n2. if (acl.sd_size < sizeof(struct smb_ntsd)) is true, original code\n   returned success without freeing sd_buf and left stale *pntsd.\n   Set rc = -EINVAL before jumping to out_free to return error code and\n   free buffer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cb69d4d6f709f87c94afa28ae64c501576692171","lessThan":"f46a70a082bdbfecbe074af8a719c26c4deb58c6","versionType":"git","status":"affected"},{"version":"8f0541186e9ad1b62accc9519cc2b7a7240272a7","lessThan":"86c2625fb9863139b359805fc6be1e31edbd3d65","versionType":"git","status":"affected"},{"version":"8f0541186e9ad1b62accc9519cc2b7a7240272a7","lessThan":"edc17db83085624a2b1bacf6a4521d7f15571737","versionType":"git","status":"affected"},{"version":"8f0541186e9ad1b62accc9519cc2b7a7240272a7","lessThan":"c3836f55e0dab96314774215e12d87f63fa919f2","versionType":"git","status":"affected"},{"version":"8f0541186e9ad1b62accc9519cc2b7a7240272a7","lessThan":"6e6329322ad733c5b23555c609353841560b26bc","versionType":"git","status":"affected"},{"version":"8f0541186e9ad1b62accc9519cc2b7a7240272a7","lessThan":"d708a36634bb7b6f94d0e76d587d2ec50b2b93b5","versionType":"git","status":"affected"},{"version":"6e8f4abf584253cbaa596ea4ad13110cf61cd4c9","versionType":"git","status":"affected"},{"version":"8e33102309bd6839b2e2e158f93a7b378cb4655d","versionType":"git","status":"affected"},{"version":"5.15.62","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"5.18.18","lessThan":"5.19","versionType":"semver","status":"affected"},{"version":"5.19.2","lessThan":"5.20","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6e6329322ad733c5b23555c609353841560b26bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/86c2625fb9863139b359805fc6be1e31edbd3d65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3836f55e0dab96314774215e12d87f63fa919f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d708a36634bb7b6f94d0e76d587d2ec50b2b93b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/edc17db83085624a2b1bacf6a4521d7f15571737","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f46a70a082bdbfecbe074af8a719c26c4deb58c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93812","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:14.657","lastModified":"2026-10-03T11:17:50.993","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr\n\nndr_encode_v4_ntacl() allocates sd_ndr.data via kzalloc() at entry.\nIf any subsequent ndr_write_*() call returns error during encoding,\nthe allocated sd_ndr.data won't be freed and causes memory leak.\n\nMove kfree(sd_ndr.data) into out label to ensure the buffer gets\nreleased on all success and error return paths."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"303fff2b8c77a85c62dbde3b27c24b084144c04c","lessThan":"306d6f370da7e0e5532dc51c972f4ce101e42431","versionType":"git","status":"affected"},{"version":"303fff2b8c77a85c62dbde3b27c24b084144c04c","lessThan":"dc55270e410ccb4d24e637c13b5c4c25bcd106d7","versionType":"git","status":"affected"},{"version":"303fff2b8c77a85c62dbde3b27c24b084144c04c","lessThan":"c866c3314a6853eb06c7a8bef67f43c8a8bdfb6e","versionType":"git","status":"affected"},{"version":"303fff2b8c77a85c62dbde3b27c24b084144c04c","lessThan":"9b4dec75498fd0a1c9eaea680aef59c9519eb16f","versionType":"git","status":"affected"},{"version":"303fff2b8c77a85c62dbde3b27c24b084144c04c","lessThan":"c521dd78e036b5e0cfd394dd2ff2218890dd9e41","versionType":"git","status":"affected"},{"version":"303fff2b8c77a85c62dbde3b27c24b084144c04c","lessThan":"d4d56b00c7df88cd5751e7415bdfabc9fdbc82a7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/306d6f370da7e0e5532dc51c972f4ce101e42431","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b4dec75498fd0a1c9eaea680aef59c9519eb16f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c521dd78e036b5e0cfd394dd2ff2218890dd9e41","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c866c3314a6853eb06c7a8bef67f43c8a8bdfb6e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d4d56b00c7df88cd5751e7415bdfabc9fdbc82a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc55270e410ccb4d24e637c13b5c4c25bcd106d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93813","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:14.763","lastModified":"2026-10-03T11:17:51.120","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: tree-checker: validate INODE_REF's namelen\n\n[BUG]\nA crafted btrfs image can trigger the following crash:\n\n  BUG: unable to handle page fault for address: ffffd1dc42884000\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  CPU: 9 UID: 0 PID: 1034 Comm: poc Not tainted 7.1.0-rc4-custom+ #383 PREEMPT(full)  46af0a92938a63be7132e0dfd71e62327c51d5c2\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\n  RIP: 0010:memcpy+0xc/0x10\n  Call Trace:\n   <TASK>\n   read_extent_buffer+0xe4/0x100 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f]\n   btrfs_get_name+0x15e/0x1e0 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f]\n   reconnect_path+0x165/0x390\n   exportfs_decode_fh_raw+0x337/0x400\n   ? drop_caches_sysctl_handler+0xb0/0xb0\n   </TASK>\n  ---[ end trace 0000000000000000 ]---\n  RIP: 0010:memcpy+0xc/0x10\n  Kernel panic - not syncing: Fatal exception\n\n[CAUSE]\nTThe crafted image has the following corrupted INODE_REF item:\n\n         item 9 key (258 INODE_REF 257) itemoff 11544 itemsize 4106\n         \tindex 2 namelen 4096 name: d\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\n\nThe itemsize matches the namelen, but the namelen is 4096, way larger\nthan normal name length limit (BTRFS_NAME_LEN, 255).\n\nMeanwhile the memory of the @name is only 255 byte sized, this will cause\nout-of-boundary access, and cause the above crash.\n\n[FIX]\nAdd extra namelen verification for INODE_REF, just like what we have\ndone in ROOT_REF checks.\n\nNow the crafted image can be rejected gracefully:\n\n BTRFS critical (device dm-2): corrupt leaf: root=5 block=30572544 slot=14 ino=259, invalid inode ref name length, has 4096 expect [1, 255]\n BTRFS error (device dm-2): read time tree block corruption detected on logical 30572544 mirror 2\n\n[ Rebase, add a Link: tag, add an simple cause analyze ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/tree-checker.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2ede0daf01549cecf4bb0962c46dc47382047523","lessThan":"60078a3e25c09d9d8fba828b0d81bb33e449a1b2","versionType":"git","status":"affected"},{"version":"2ede0daf01549cecf4bb0962c46dc47382047523","lessThan":"509d6a4d889e425f305461d8323a7b39ca6c121c","versionType":"git","status":"affected"},{"version":"2ede0daf01549cecf4bb0962c46dc47382047523","lessThan":"4cb41f07685f88ec724a375883bb0c731db8f6eb","versionType":"git","status":"affected"},{"version":"2ede0daf01549cecf4bb0962c46dc47382047523","lessThan":"eeddee090b834a7d4b6a8214d2e3739e64c7a338","versionType":"git","status":"affected"},{"version":"2ede0daf01549cecf4bb0962c46dc47382047523","lessThan":"8f75c19892263bc0555fba922aefe103e841e86d","versionType":"git","status":"affected"},{"version":"2ede0daf01549cecf4bb0962c46dc47382047523","lessThan":"3dc22abc21f5892406c09202fa2627196cc96967","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/tree-checker.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.37","status":"affected"},{"version":"0","lessThan":"2.6.37","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3dc22abc21f5892406c09202fa2627196cc96967","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4cb41f07685f88ec724a375883bb0c731db8f6eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/509d6a4d889e425f305461d8323a7b39ca6c121c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/60078a3e25c09d9d8fba828b0d81bb33e449a1b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f75c19892263bc0555fba922aefe103e841e86d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eeddee090b834a7d4b6a8214d2e3739e64c7a338","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93814","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:14.897","lastModified":"2026-10-03T11:17:51.293","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: core: Abort active target transfer on controller suspend\n\nWhen an SPI controller operating in target mode has a transfer in\nprogress at the time of system suspend, the suspend path proceeds\nwithout aborting the ongoing transfer. This can leave the hardware in\nan inconsistent state, potentially causing the system to hang or fail\nto resume cleanly.\n\nFix this by invoking the controller's target_abort callback from\nspi_controller_suspend() when the controller is in target mode and the\ncallback is registered. This ensures any active target transfer is\ncleanly terminated before the controller is suspended."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/spi/spi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6c364062bfed3c34490e85bea52ff6e2d4f0f281","lessThan":"a75d9eb78c89d3fa8d503966c91a51f02eced768","versionType":"git","status":"affected"},{"version":"6c364062bfed3c34490e85bea52ff6e2d4f0f281","lessThan":"1cc84ca8599b8fa64014821bca453ebb3326c71e","versionType":"git","status":"affected"},{"version":"6c364062bfed3c34490e85bea52ff6e2d4f0f281","lessThan":"b81ac605763c319ca9928a237818ab4e8ab7bb59","versionType":"git","status":"affected"},{"version":"6c364062bfed3c34490e85bea52ff6e2d4f0f281","lessThan":"f6a0cafa265c8a4aed585d873747e3b88b146eed","versionType":"git","status":"affected"},{"version":"6c364062bfed3c34490e85bea52ff6e2d4f0f281","lessThan":"c1bab046d4786c5b17aab7c5225bf0d4a2a2d19b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/spi/spi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.13","status":"affected"},{"version":"0","lessThan":"4.13","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1cc84ca8599b8fa64014821bca453ebb3326c71e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a75d9eb78c89d3fa8d503966c91a51f02eced768","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b81ac605763c319ca9928a237818ab4e8ab7bb59","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c1bab046d4786c5b17aab7c5225bf0d4a2a2d19b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f6a0cafa265c8a4aed585d873747e3b88b146eed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93815","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.010","lastModified":"2026-10-03T11:17:51.403","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: au1000: move free_irq out of the close-time spinlocked section\n\nau1000_close() calls free_irq() while aup->lock is still held with\nspin_lock_irqsave(). free_irq() can sleep because it takes the IRQ\ndescriptor request mutex, so it does not belong inside the close-time\nspinlocked section.\n\nThis was found by our static analysis tool and then confirmed by manual\nreview of the in-tree au1000_close() .ndo_stop path. The reviewed path\nkeeps aup->lock held across the MAC reset, queue stop and\nfree_irq(dev->irq, dev).\n\nA directed runtime validation kept that ndo_stop carrier and the same\nfree_irq(dev->irq, dev) operation under the driver lock. Lockdep reported\n\"BUG: sleeping function called from invalid context\" and \"Invalid wait\ncontext\" while free_irq() was taking desc->request_mutex, with\nau1000_close() and free_irq() on the stack.\n\nDrop aup->lock before freeing the IRQ. The protected close-time work still\nstops the device and queue before IRQ teardown, but the sleepable IRQ core\npath now runs outside the spinlocked section."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/amd/au1000_eth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f86bca5b7857b85bfa8afdb4fa895d7c0a3f7ebc","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"26fd652915123a690f19d62b253b545a53f3cd51","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d514b08ed61fdffe23604fd3e9e53c07cbe5ac3e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e1b5a13249975fec3cf654efa84f57118db2da2c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4536667fba8ddbaff2f2a135080ae6aabf737b5e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"fc2233f1ab2a1ca562869bca6987d7477671388c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f48763beab4eea41fc480c9702ec6eebe8d75e4f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/amd/au1000_eth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/26fd652915123a690f19d62b253b545a53f3cd51","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4536667fba8ddbaff2f2a135080ae6aabf737b5e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d514b08ed61fdffe23604fd3e9e53c07cbe5ac3e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e1b5a13249975fec3cf654efa84f57118db2da2c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f48763beab4eea41fc480c9702ec6eebe8d75e4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f86bca5b7857b85bfa8afdb4fa895d7c0a3f7ebc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc2233f1ab2a1ca562869bca6987d7477671388c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93816","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.120","lastModified":"2026-10-03T11:17:51.527","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: validate inline dentry name lengths before conversion\n\nInline dentry conversion copies names out of the inline dentry area\nbefore checking that each recorded name length fits in the available\nfilename slots.\n\nA corrupted image can therefore make the conversion path read past\nthe inline filename storage while building the regular dentry block.\n\nValidate each inline dentry name length against the inline filename\narea before copying it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/f2fs/inline.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"675f10bde6cc3874632a8f684df2a8a2a8ace76e","lessThan":"6b5552449fc5acb8e6ecf045b46702b29b71165a","versionType":"git","status":"affected"},{"version":"675f10bde6cc3874632a8f684df2a8a2a8ace76e","lessThan":"6343208fd73f3f2b8044c0922185cd13ff807693","versionType":"git","status":"affected"},{"version":"675f10bde6cc3874632a8f684df2a8a2a8ace76e","lessThan":"4dd81faa63fd54b9ba1a83c304e6d0bd03f1898d","versionType":"git","status":"affected"},{"version":"675f10bde6cc3874632a8f684df2a8a2a8ace76e","lessThan":"aee4e6de71ca77626c006166ff00f1d01ff990c9","versionType":"git","status":"affected"},{"version":"675f10bde6cc3874632a8f684df2a8a2a8ace76e","lessThan":"2ce0bc5853bec7cdc724477a87ea579fde664243","versionType":"git","status":"affected"},{"version":"675f10bde6cc3874632a8f684df2a8a2a8ace76e","lessThan":"7caa8a0ae94b132576c2e46e9b4fd4e0f356f373","versionType":"git","status":"affected"},{"version":"675f10bde6cc3874632a8f684df2a8a2a8ace76e","lessThan":"cfcd0e49a178b3dac2c0ece656079081dbf5da74","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/f2fs/inline.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/2ce0bc5853bec7cdc724477a87ea579fde664243","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4dd81faa63fd54b9ba1a83c304e6d0bd03f1898d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6343208fd73f3f2b8044c0922185cd13ff807693","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b5552449fc5acb8e6ecf045b46702b29b71165a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7caa8a0ae94b132576c2e46e9b4fd4e0f356f373","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aee4e6de71ca77626c006166ff00f1d01ff990c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfcd0e49a178b3dac2c0ece656079081dbf5da74","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93817","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.233","lastModified":"2026-10-21T13:21:08.397","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix addr_filter_ranges lifetime\n\nLee Jia Jie reported that since event::addr_filter_ranges is used\nunder RCU, it should be RCU freed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"375637bc524952f1122ea22caf5a8f1fecad8228","lessThan":"1d8e1e99b063de4179cc8af14d08115d74a37abf","versionType":"git","status":"affected"},{"version":"375637bc524952f1122ea22caf5a8f1fecad8228","lessThan":"cd8dab11046c03ab07899ce3fe2aa7d1a9702cf1","versionType":"git","status":"affected"},{"version":"375637bc524952f1122ea22caf5a8f1fecad8228","lessThan":"6f1853b2b9f38f1343790bae8c0601b3f7554754","versionType":"git","status":"affected"},{"version":"375637bc524952f1122ea22caf5a8f1fecad8228","lessThan":"e62d4192e593630f355094adc467058a05bdc935","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1d8e1e99b063de4179cc8af14d08115d74a37abf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f1853b2b9f38f1343790bae8c0601b3f7554754","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cd8dab11046c03ab07899ce3fe2aa7d1a9702cf1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e62d4192e593630f355094adc467058a05bdc935","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93818","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.350","lastModified":"2026-09-25T13:17:22.683","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: plda: Protect root bus removal with rescan lock\n\nHold the pci_rescan_remove_lock lock while stopping and removing a root bus\nto avoid racing with concurrent rescan or hotplug operations triggered via\nsysfs.  Such races may lead to use-after-free issues or system crashes.\n\n[bhelgaas: commit log]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/controller/plda/pcie-plda-host.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"76c9113968079140cb2f885631db422170f32105","lessThan":"105f212a21cc6bef6855841216dd476022626170","versionType":"git","status":"affected"},{"version":"76c9113968079140cb2f885631db422170f32105","lessThan":"cb78a1d7a2787758a2d8e1182c346d4349f43260","versionType":"git","status":"affected"},{"version":"76c9113968079140cb2f885631db422170f32105","lessThan":"4e4f9745f016c1631d00a4035b06f6e75d449e01","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/controller/plda/pcie-plda-host.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/105f212a21cc6bef6855841216dd476022626170","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4e4f9745f016c1631d00a4035b06f6e75d449e01","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cb78a1d7a2787758a2d8e1182c346d4349f43260","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93819","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.467","lastModified":"2026-10-03T11:17:51.670","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: mediatek: Protect root bus removal with rescan lock\n\nHold the pci_rescan_remove_lock lock while stopping and removing a root bus\nto avoid racing with concurrent rescan or hotplug operations triggered via\nsysfs.  Such races may lead to use-after-free issues or system crashes.\n\n[bhelgaas: commit log]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/controller/pcie-mediatek.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"031337ace2d1c22a447da6390716fe92592cdd6e","lessThan":"d54417acb22d9e8bc404a8598330bc9729ee7146","versionType":"git","status":"affected"},{"version":"031337ace2d1c22a447da6390716fe92592cdd6e","lessThan":"5dd379acfa38c516e904bcfa693502cd585a0bba","versionType":"git","status":"affected"},{"version":"031337ace2d1c22a447da6390716fe92592cdd6e","lessThan":"8d910649725955435c6a807944108bca0570712d","versionType":"git","status":"affected"},{"version":"031337ace2d1c22a447da6390716fe92592cdd6e","lessThan":"31e33dcc896527b3ad790fdc6aa6b8d2995c078b","versionType":"git","status":"affected"},{"version":"031337ace2d1c22a447da6390716fe92592cdd6e","lessThan":"c57b971765f835138fa2fce3f2a171b004cbb114","versionType":"git","status":"affected"},{"version":"031337ace2d1c22a447da6390716fe92592cdd6e","lessThan":"a568939487dcbc1a3e341208585e224be897e25e","versionType":"git","status":"affected"},{"version":"031337ace2d1c22a447da6390716fe92592cdd6e","lessThan":"a29812a55da8d0dbeb071b26ac428c338e3fc389","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/controller/pcie-mediatek.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/31e33dcc896527b3ad790fdc6aa6b8d2995c078b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5dd379acfa38c516e904bcfa693502cd585a0bba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8d910649725955435c6a807944108bca0570712d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a29812a55da8d0dbeb071b26ac428c338e3fc389","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a568939487dcbc1a3e341208585e224be897e25e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c57b971765f835138fa2fce3f2a171b004cbb114","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d54417acb22d9e8bc404a8598330bc9729ee7146","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93820","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.573","lastModified":"2026-10-03T11:17:51.790","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: rockchip: Protect root bus removal with rescan lock\n\nHold the pci_rescan_remove_lock lock while stopping and removing a root bus\nto avoid racing with concurrent rescan or hotplug operations triggered via\nsysfs.  Such races may lead to use-after-free issues or system crashes.\n\n[bhelgaas: commit log]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/controller/pcie-rockchip-host.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"073d3dbe9a7c38888d8dafe09df421b174a6cffa","lessThan":"025308e7c9cd10112b73558c9f63f8f7285fa726","versionType":"git","status":"affected"},{"version":"073d3dbe9a7c38888d8dafe09df421b174a6cffa","lessThan":"ac47d42901859edb504a2890a3a5709c86dbc0c3","versionType":"git","status":"affected"},{"version":"073d3dbe9a7c38888d8dafe09df421b174a6cffa","lessThan":"eaeb9bed3641741aceb0add84a97023bed61e748","versionType":"git","status":"affected"},{"version":"073d3dbe9a7c38888d8dafe09df421b174a6cffa","lessThan":"5d566ac3a055f0a6f4890ff0af7cfd7e8ed89652","versionType":"git","status":"affected"},{"version":"073d3dbe9a7c38888d8dafe09df421b174a6cffa","lessThan":"ebca7e5947720e9d4bd918af3e17720270c50744","versionType":"git","status":"affected"},{"version":"073d3dbe9a7c38888d8dafe09df421b174a6cffa","lessThan":"9b19201f57d87c4d0777621275dbc59bff41b7f2","versionType":"git","status":"affected"},{"version":"073d3dbe9a7c38888d8dafe09df421b174a6cffa","lessThan":"0bd9611587bb494c33566d825fe34b2705e4b167","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/controller/pcie-rockchip-host.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/025308e7c9cd10112b73558c9f63f8f7285fa726","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0bd9611587bb494c33566d825fe34b2705e4b167","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d566ac3a055f0a6f4890ff0af7cfd7e8ed89652","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b19201f57d87c4d0777621275dbc59bff41b7f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac47d42901859edb504a2890a3a5709c86dbc0c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eaeb9bed3641741aceb0add84a97023bed61e748","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ebca7e5947720e9d4bd918af3e17720270c50744","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93821","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.690","lastModified":"2026-10-03T11:17:51.897","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: altera: Protect root bus removal with rescan lock\n\nHold the pci_rescan_remove_lock lock while stopping and removing a root bus\nto avoid racing with concurrent rescan or hotplug operations triggered via\nsysfs.  Such races may lead to use-after-free issues or system crashes.\n\n[bhelgaas: commit log]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/controller/pcie-altera.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ec15c4d0d5d2e431169fbdf6c6bcf0c8ff71ef22","lessThan":"cf9d84d1b6a7c3f3780c043df220a7e9e38137eb","versionType":"git","status":"affected"},{"version":"ec15c4d0d5d2e431169fbdf6c6bcf0c8ff71ef22","lessThan":"fc462f1bdeaea9789928cbfdf5e069ee559c7642","versionType":"git","status":"affected"},{"version":"ec15c4d0d5d2e431169fbdf6c6bcf0c8ff71ef22","lessThan":"442b7f2a093b4a75f8963aaa7cbb2b8df35a6ac3","versionType":"git","status":"affected"},{"version":"ec15c4d0d5d2e431169fbdf6c6bcf0c8ff71ef22","lessThan":"4b69c63cc247fc0f499fbd11076fee9c2a6e6fd7","versionType":"git","status":"affected"},{"version":"ec15c4d0d5d2e431169fbdf6c6bcf0c8ff71ef22","lessThan":"c0cd65906e5f7e293ef2568c9524cc0a918333c3","versionType":"git","status":"affected"},{"version":"ec15c4d0d5d2e431169fbdf6c6bcf0c8ff71ef22","lessThan":"7cbb8f2750d91e64caff89e164ac8280bb80bedc","versionType":"git","status":"affected"},{"version":"ec15c4d0d5d2e431169fbdf6c6bcf0c8ff71ef22","lessThan":"a8759c8ac48c0419f5899e95a6ffc611b07c965b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/controller/pcie-altera.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/442b7f2a093b4a75f8963aaa7cbb2b8df35a6ac3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4b69c63cc247fc0f499fbd11076fee9c2a6e6fd7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cbb8f2750d91e64caff89e164ac8280bb80bedc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8759c8ac48c0419f5899e95a6ffc611b07c965b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0cd65906e5f7e293ef2568c9524cc0a918333c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf9d84d1b6a7c3f3780c043df220a7e9e38137eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc462f1bdeaea9789928cbfdf5e069ee559c7642","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93822","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.813","lastModified":"2026-10-03T11:17:52.010","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: iproc: Protect root bus removal with rescan lock\n\nHold the pci_rescan_remove_lock lock while stopping and removing a root bus\nto avoid racing with concurrent rescan or hotplug operations triggered via\nsysfs.  Such races may lead to use-after-free issues or system crashes.\n\n[bhelgaas: commit log]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/controller/pcie-iproc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1fb37a8178da007cad75f48e2355b9dcb0711e06","lessThan":"e7d9d7be2c1f8d434032983bc86a05805178c9c9","versionType":"git","status":"affected"},{"version":"1fb37a8178da007cad75f48e2355b9dcb0711e06","lessThan":"1618e374ba4c7117c04662422ef985e9d64e2466","versionType":"git","status":"affected"},{"version":"1fb37a8178da007cad75f48e2355b9dcb0711e06","lessThan":"4e1d34d824050a4e700ca442f815a95d9f214b83","versionType":"git","status":"affected"},{"version":"1fb37a8178da007cad75f48e2355b9dcb0711e06","lessThan":"aaf4153caed9f1760b9f266612b0599bfd97150c","versionType":"git","status":"affected"},{"version":"1fb37a8178da007cad75f48e2355b9dcb0711e06","lessThan":"bd2bf1e0d973c93fc1637b90cbb9a5a5f6884bd3","versionType":"git","status":"affected"},{"version":"1fb37a8178da007cad75f48e2355b9dcb0711e06","lessThan":"ee06aafc2d760a4ee023e0b2e95ce1ec71bddc6c","versionType":"git","status":"affected"},{"version":"1fb37a8178da007cad75f48e2355b9dcb0711e06","lessThan":"a6a64e150f12ad5391e0a0d60f6a3d119b06ce50","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/controller/pcie-iproc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.1","status":"affected"},{"version":"0","lessThan":"4.1","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1618e374ba4c7117c04662422ef985e9d64e2466","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4e1d34d824050a4e700ca442f815a95d9f214b83","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6a64e150f12ad5391e0a0d60f6a3d119b06ce50","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aaf4153caed9f1760b9f266612b0599bfd97150c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd2bf1e0d973c93fc1637b90cbb9a5a5f6884bd3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7d9d7be2c1f8d434032983bc86a05805178c9c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee06aafc2d760a4ee023e0b2e95ce1ec71bddc6c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93823","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.947","lastModified":"2026-10-03T11:17:52.120","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl\n\namdkfd driver needs allocate buffer to return bo metadata to user space. The\nbuffer size is controlled by user currently. It is a potential security issue\nthat hostile value (e.g. 2 GiB) lets any render-group user trigger order-MAX\nallocation/OOM in kernel context.\n\nThis patch first finds bo metadata size. If the size is smaller than user\nprovided value drive can safely allocate buffer in kernel space and copy to\nuser space buffer. If not, driver will let user know, not allocate and copy.\nUser will redo with new buffer in user space.\n\nThis patch lets driver decide buffer allocation size to avoid potential hostile\nsize from user space.\n\n(cherry picked from commit f54ce9e8cbd3abe0eda3a285f54dc4f572fe589a)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c","drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h","drivers/gpu/drm/amd/amdkfd/kfd_chardev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1dde0ea95b782425b95455d487cb44991525a1d1","lessThan":"d51841bb5ceee75ec3aeeb4e5c51c8e5e7524228","versionType":"git","status":"affected"},{"version":"1dde0ea95b782425b95455d487cb44991525a1d1","lessThan":"a65ccabde6deb95baf9442bd98299e2248884162","versionType":"git","status":"affected"},{"version":"1dde0ea95b782425b95455d487cb44991525a1d1","lessThan":"2d9fd0f01550aab4a0a1984b4379e50545906248","versionType":"git","status":"affected"},{"version":"1dde0ea95b782425b95455d487cb44991525a1d1","lessThan":"8242a8d9d7194d5ef8a8b38a5621ca0966a3ec15","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c","drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h","drivers/gpu/drm/amd/amdkfd/kfd_chardev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2d9fd0f01550aab4a0a1984b4379e50545906248","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8242a8d9d7194d5ef8a8b38a5621ca0966a3ec15","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a65ccabde6deb95baf9442bd98299e2248884162","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d51841bb5ceee75ec3aeeb4e5c51c8e5e7524228","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93824","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:16.073","lastModified":"2026-10-03T11:17:52.223","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntls: reject the combination of TLS and sockmap\n\nTLS and sockmap (BPF psock) integration hides a lot of latent bugs.\nBugs which may be more or less relevant for real users but they\nare definitely exploitable.\n\nWe could not find anyone actively using this integration so let's\nreject this config. Adding a TLS socket to a sockmap was already\nrejected by sk_psock_init() through the inet_csk_has_ulp() check.\nWe need to reject the attempts to configure the TLS keys (rather\nthan adding the ULP itself) because checking prior to the ULP\ninstallation is tricky without risking a race with sockmap getting\nadded in parallel (sockmap does not hold the socket lock).\n\nThis patch is a minimal rejection of the feature. Subsequent patch\nin the series will do a light dead code removal. Full cleanup would\nrequire a major rewrite of the Tx path, we don't need skmsg any more."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/tls/tls_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca","lessThan":"c4896592744f30ff026f799947c5978bcfd7c8c7","versionType":"git","status":"affected"},{"version":"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca","lessThan":"e26aa709454d48c3b3ef8d3100c8a04e7d9fd94e","versionType":"git","status":"affected"},{"version":"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca","lessThan":"c3d4d537337f69e405a36fa561e7292ee4148bf7","versionType":"git","status":"affected"},{"version":"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca","lessThan":"a08e780b6cc1153cbff8be55de9ec9da809e344f","versionType":"git","status":"affected"},{"version":"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca","lessThan":"460e6486617c17dd19abe8f3fc67d9a6fa25f8ca","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/tls/tls_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/460e6486617c17dd19abe8f3fc67d9a6fa25f8ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a08e780b6cc1153cbff8be55de9ec9da809e344f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3d4d537337f69e405a36fa561e7292ee4148bf7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4896592744f30ff026f799947c5978bcfd7c8c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e26aa709454d48c3b3ef8d3100c8a04e7d9fd94e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93825","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:16.193","lastModified":"2026-10-03T11:17:52.330","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()\n\nPrevent NULL pointer dereference when spi_get_device_id() returns NULL,\nwhich can happen when using driver_override without matching SPI ID entry."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/spi/spi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bd1be85dbbbd4076e8dbdceefc3c4d2c673e0075","lessThan":"1fa4484116d14a0356edfeb6ecc7ea3b370911b1","versionType":"git","status":"affected"},{"version":"027eaeaf3294607104e90e84cec3f55e792cab22","lessThan":"aa966ccea3584a70c9a6030f4a16577030db35e5","versionType":"git","status":"affected"},{"version":"aea672d054a21782ed8450c75febb6ba3c208ca4","lessThan":"359b3442e66c595ed03e5a6b0493b66600c63941","versionType":"git","status":"affected"},{"version":"aea672d054a21782ed8450c75febb6ba3c208ca4","lessThan":"3fcd9415144f4fbd21e1bef35a7f8dbd734f607d","versionType":"git","status":"affected"},{"version":"aea672d054a21782ed8450c75febb6ba3c208ca4","lessThan":"72cc9c6d6fba5b4e0aaf89126884a56bb54b92f8","versionType":"git","status":"affected"},{"version":"aea672d054a21782ed8450c75febb6ba3c208ca4","lessThan":"f1b061b4d4c6cbf861319ba954caa80145cf018f","versionType":"git","status":"affected"},{"version":"5.15.146","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"6.1.71","lessThan":"6.1.189","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/spi/spi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1fa4484116d14a0356edfeb6ecc7ea3b370911b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/359b3442e66c595ed03e5a6b0493b66600c63941","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3fcd9415144f4fbd21e1bef35a7f8dbd734f607d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72cc9c6d6fba5b4e0aaf89126884a56bb54b92f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa966ccea3584a70c9a6030f4a16577030db35e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1b061b4d4c6cbf861319ba954caa80145cf018f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93826","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:16.297","lastModified":"2026-10-03T11:17:52.437","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hidpp: fix potential UAF in hidpp_connect_event()\n\nIf input_register_device() fails, we call input_free_device(), but keep\nstale pointer to the old device in hidpp->input, which could potentially\nlead to UAF. Fix that by resetting it to NULL before returning from\nhidpp_connect_event()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hid/hid-logitech-hidpp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c39e3d5fc9dd3e16c6f59dd94d827540040de66d","lessThan":"e03fd646adad7f97fa4429ec5f38cee9bde5276e","versionType":"git","status":"affected"},{"version":"c39e3d5fc9dd3e16c6f59dd94d827540040de66d","lessThan":"5d7637f4d050d105177217e64b869f56f9825060","versionType":"git","status":"affected"},{"version":"c39e3d5fc9dd3e16c6f59dd94d827540040de66d","lessThan":"3b8b2e58b078cd30e121401535541bb8a6d57133","versionType":"git","status":"affected"},{"version":"c39e3d5fc9dd3e16c6f59dd94d827540040de66d","lessThan":"3303398cc2aa255ba251650a30024e11d48ea6c3","versionType":"git","status":"affected"},{"version":"c39e3d5fc9dd3e16c6f59dd94d827540040de66d","lessThan":"6df6b1f2c49678211f65647c300bc51dda02893b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hid/hid-logitech-hidpp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.19","status":"affected"},{"version":"0","lessThan":"3.19","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3303398cc2aa255ba251650a30024e11d48ea6c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b8b2e58b078cd30e121401535541bb8a6d57133","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d7637f4d050d105177217e64b869f56f9825060","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6df6b1f2c49678211f65647c300bc51dda02893b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e03fd646adad7f97fa4429ec5f38cee9bde5276e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93827","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:16.410","lastModified":"2026-09-25T13:17:23.513","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-fs: avoid double-free on failed queue setup\n\nvirtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling\nvirtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both\npointers and returns an error to virtio_fs_probe().\n\nvirtio_fs_probe() then drops the last kobject reference, and\nvirtio_fs_ktype_release() frees fs->vqs and fs->mq_map again. This leaves\ndangling pointers in struct virtio_fs and can trigger a double-free during\nprobe failure cleanup.\n\nSet fs->vqs and fs->mq_map to NULL immediately after kfree() in the\nvirtio_fs_setup_vqs() error path so that the later kobject release sees an\nuninitialized state and kfree(NULL) becomes harmless.\n\nThis can be reproduced when a broken virtio-fs device advertises more\nrequest queues than the transport actually provides. In that case\nvirtio_find_vqs() fails while setting up the extra queue, and the probe\npath reaches the double-free cleanup sequence."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/fuse/virtio_fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9","lessThan":"3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad","versionType":"git","status":"affected"},{"version":"a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9","lessThan":"20ef4739b329bb09cff11dd2458795a50674658e","versionType":"git","status":"affected"},{"version":"a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9","lessThan":"6af3330ec5d5fb8c06c04eb520a71cf73ea5a765","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/fuse/virtio_fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/20ef4739b329bb09cff11dd2458795a50674658e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6af3330ec5d5fb8c06c04eb520a71cf73ea5a765","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93828","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:16.517","lastModified":"2026-10-21T13:21:08.547","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix handling of damaged volume in exfat_create_upcase_table()\n\nWhen the size of the upcase table is set to zero in the dentry for any\nreason(e.g. corrupted media or misbehaving device), an integer overflow\ncauses the module to loop indefinitely.\n\nIf the size of the upcase table is read zero, do not attempt to load the\ntable. Instead, fallback to loading the default upcase table. If the\nsize of the upcase table is zero or no upcase table is found, raise\nexfat_fs_error() to mark the volume read-only."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/exfat/nls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"370e812b3ec190fa492c9fd5a80c38b086d105c0","lessThan":"29723256fccf46e55c2a44bd6b8345bef7ba079b","versionType":"git","status":"affected"},{"version":"370e812b3ec190fa492c9fd5a80c38b086d105c0","lessThan":"60ace93811609e4dd883e9de5fb4462ed834160a","versionType":"git","status":"affected"},{"version":"370e812b3ec190fa492c9fd5a80c38b086d105c0","lessThan":"2cc0b612343638057ef321ce735201a7c2f52f25","versionType":"git","status":"affected"},{"version":"370e812b3ec190fa492c9fd5a80c38b086d105c0","lessThan":"20dd3185d13865214ff25b0bf7b931e8d73be1ac","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/exfat/nls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/20dd3185d13865214ff25b0bf7b931e8d73be1ac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29723256fccf46e55c2a44bd6b8345bef7ba079b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2cc0b612343638057ef321ce735201a7c2f52f25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/60ace93811609e4dd883e9de5fb4462ed834160a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93829","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:16.630","lastModified":"2026-10-03T11:17:52.570","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix races in cifsd thread creation\n\nThe cifsd demultiplex thread can run and access tcp_ses before the parent\nthread has finished populating tcp_ses, which the worker thread accesses\nlocklessly.\n\nAlso, the kthread_run macro may start the thread before returning the\nthread pointer. Because the pointer is part of the structure that the\nthread can access, if the kernel is preempted after the thread is spawned,\nbut before the thread pointer is populated and the thread attempts to exit,\nit will sleep, waiting for a SIGKILL signal.\n\nFix this by moving creation of the thread to after all of tcp_ses'es\nfields are populated, and spawning the thread last, using a split\nkthread_create/wake_up_process logic."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/connect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"aaf737adb6937339494d5a7111f0433cd9676db8","lessThan":"cfa09f63e75cf440c9be97d1e73d509bfbb2c2c5","versionType":"git","status":"affected"},{"version":"aaf737adb6937339494d5a7111f0433cd9676db8","lessThan":"ee8f811cbac56ffb738b3a73671a9e75b0f56e99","versionType":"git","status":"affected"},{"version":"aaf737adb6937339494d5a7111f0433cd9676db8","lessThan":"0eee1e6cddd1d9ce14da06e0238ca8d3362dec90","versionType":"git","status":"affected"},{"version":"aaf737adb6937339494d5a7111f0433cd9676db8","lessThan":"e8a5cf2ff5a13fefb228f2069e29dd7d8e37185d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/connect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.22","status":"affected"},{"version":"0","lessThan":"2.6.22","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0eee1e6cddd1d9ce14da06e0238ca8d3362dec90","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfa09f63e75cf440c9be97d1e73d509bfbb2c2c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8a5cf2ff5a13fefb228f2069e29dd7d8e37185d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee8f811cbac56ffb738b3a73671a9e75b0f56e99","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93830","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:16.740","lastModified":"2026-10-03T11:17:52.673","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: xgmac2: disable RBUE in default RX interrupt mask\n\nEnabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive\nand can trigger a MAC interrupt storm under heavy RX pressure. When the\nDMA runs out of RX descriptors it fires RBUE continuously until software\nrefills the ring.\n\nHowever, RBUE is redundant: the normal RX completion interrupt (RIE)\nalready triggers NAPI, which processes completed descriptors and refills\nthe ring, causing the DMA to resume. The RBUE handler itself only sets\nhandle_rx - the same outcome as RIE.\n\nOn Agilex5 under heavy RX pressure, the MAC interrupt (which includes\nRBUE) was observed firing 1,821,811,555 times against only 2,618,627\nactual RX completions - a ~695x ratio - confirming the severity of the\nstorm.\n\nRBUE does not provide OOM recovery. If page_pool is exhausted,\nstmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays\nsuspended, and RBUE fires again on the next NAPI completion - a storm\nwith no forward progress. This patch trades that storm for a clean\nstall with the same RX outcome. Proper OOM recovery is a pre-existing\ngap outside the scope of this fix.\n\nNote: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool\ncounter will always read 0 on XGMAC2 devices. This behaviour is already\ninconsistent across DWMAC core versions.\n\nRemove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX\nto prevent the interrupt storm while keeping normal RX handling intact."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d6ddfacd95c79d43465d4a85dffb1c9beca343a9","lessThan":"8c9d57b5dc098b84631d0b3559c84c499ea2170a","versionType":"git","status":"affected"},{"version":"d6ddfacd95c79d43465d4a85dffb1c9beca343a9","lessThan":"7a10e54e42a8f73a8d731f5a281fc06bb41b9250","versionType":"git","status":"affected"},{"version":"d6ddfacd95c79d43465d4a85dffb1c9beca343a9","lessThan":"6b3b91433d5f4eae6865cdaa96f40cd67849e1f6","versionType":"git","status":"affected"},{"version":"d6ddfacd95c79d43465d4a85dffb1c9beca343a9","lessThan":"74dbb85a6a254b5fc1f265a6cd61b2ba9d9221d7","versionType":"git","status":"affected"},{"version":"d6ddfacd95c79d43465d4a85dffb1c9beca343a9","lessThan":"0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce","versionType":"git","status":"affected"},{"version":"d6ddfacd95c79d43465d4a85dffb1c9beca343a9","lessThan":"87e2826ed2058747ddf014c082569a46bfadd96b","versionType":"git","status":"affected"},{"version":"d6ddfacd95c79d43465d4a85dffb1c9beca343a9","lessThan":"d3265c19b35d036bba327b36b5366bee76b0157c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b3b91433d5f4eae6865cdaa96f40cd67849e1f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74dbb85a6a254b5fc1f265a6cd61b2ba9d9221d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a10e54e42a8f73a8d731f5a281fc06bb41b9250","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87e2826ed2058747ddf014c082569a46bfadd96b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c9d57b5dc098b84631d0b3559c84c499ea2170a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3265c19b35d036bba327b36b5366bee76b0157c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-94281","sourceIdentifier":"meissner@suse.de","published":"2026-09-24T17:17:16.860","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"x.org","product":"libXi","defaultStatus":"unaffected","packageName":"libXi","repo":"https://gitlab.freedesktop.org/xorg/lib/libxi","versions":[{"version":"0","lessThan":"1.8.4","versionType":"rpm","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:14:08.828973Z","id":"CVE-2026-94281","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=605f419d013153bf9e026cd100752ffbe930f3c1","source":"meissner@suse.de"}]}},{"cve":{"id":"CVE-2026-94604","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:16.987","lastModified":"2026-09-24T17:17:16.987","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE is a duplicate of another CVE."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-94606","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:17.063","lastModified":"2026-10-05T16:17:17.863","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An actor who knows a target user's password can substitute an attacker-controlled address, receive the one-time code, and finish enrolling the factor as the target. The target must not have enrolled the email factor already. Successful enrollment gives the actor a session as the target and access to single sign-on applications behind the account. Other authenticator types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"goauthentik","product":"authentik","versions":[{"version":"< 2026.2.7","status":"affected"},{"version":">= 2026.5.0, < 2026.5.7","status":"affected"},{"version":">= 2026.8.0, < 2026.8.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","baseScore":8.9,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:53:08.106815Z","id":"CVE-2026-94606","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-807"}]}],"references":[{"url":"https://docs.goauthentik.io/releases/2026.2#fixed-in-202627","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.5#fixed-in-202657","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.8#fixed-in-202682","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/01d4349f2aaa9beda532f92e2a251a17fefee9b3","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/1fcf9868133e5d05e266edbc1f6f3ee972baa3f9","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/c10ae83ebf8c61de2f1922edf1fab504d9f3b06f","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/ec41732339726fba477182c0906a8d930b145beb","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25958","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25963","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25968","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25973","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/security/advisories/GHSA-qgqp-xh8r-v73r","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-94609","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:17.230","lastModified":"2026-09-28T16:17:18.200","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate those privileges. Group hierarchy checks do not consistently account for superuser status inherited from ancestor groups, and role assignment to a group lacks the required authorization check. Only deployments that delegate these management capabilities to accounts that are not full administrators are affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"goauthentik","product":"authentik","versions":[{"version":"< 2026.2.7","status":"affected"},{"version":">= 2026.5.0, < 2026.5.7","status":"affected"},{"version":">= 2026.8.0, < 2026.8.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T15:41:43.925095Z","id":"CVE-2026-94609","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://docs.goauthentik.io/releases/2026.2#fixed-in-202627","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.5#fixed-in-202657","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.8#fixed-in-202682","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/5f95b86f6f70c3bd8c625a4f9ae474e235f84030","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/67317f66f1b7eb16f2a26bf550dfd73699d49d87","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/67e470dde8c81a40ee27ec6e178462368c561a60","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/898e4e4fa070642a3541a376af0de64fe3ffeb67","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25956","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25961","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25966","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25971","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/security/advisories/GHSA-h6c5-mpvq-j4jc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-94611","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:17.390","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets. Affected configurations include one-time code delivery by mail or SMS, outbound provisioning targets, device trust integrations, identity sources, the Kubernetes outpost integration, applications using a client or shared secret, and applications using a proxy provider. Deployments are affected when view permission is granted to accounts that are not intended to read these credentials; deployments where every viewer is permitted to read them are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"goauthentik","product":"authentik","versions":[{"version":"< 2026.2.7","status":"affected"},{"version":">= 2026.5.0, < 2026.5.7","status":"affected"},{"version":">= 2026.8.0, < 2026.8.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:07:45.172270Z","id":"CVE-2026-94611","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-522"}]}],"references":[{"url":"https://docs.goauthentik.io/releases/2026.2#fixed-in-202627","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.5#fixed-in-202657","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.8#fixed-in-202682","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/4b3fad38be44ef3eef1f0baf83e7b3061229eb99","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/5109a4d4998d6a5ee399ca3e22ba546231c140c7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/6bed64ef80a4dd21011cce64c41b1e7c5640ecb3","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/77d2e24442c3eb6e88010f40aa569a8bfb584f99","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25955","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25960","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25965","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25970","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/security/advisories/GHSA-m9h4-7j9c-55x9","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-94612","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:17.557","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that Source. The SAML Source also does not record already accepted assertions, allowing replay. An unauthenticated actor who possesses such a valid assertion can use an assertion intended for another service provider or reuse an earlier assertion to authenticate as the user named by the assertion. Only SAML Sources are affected; SAML Providers and other Source types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"goauthentik","product":"authentik","versions":[{"version":"< 2026.2.7","status":"affected"},{"version":">= 2026.5.0, < 2026.5.7","status":"affected"},{"version":">= 2026.8.0, < 2026.8.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:15:17.274740Z","id":"CVE-2026-94612","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-345"}]}],"references":[{"url":"https://docs.goauthentik.io/releases/2026.2#fixed-in-202627","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.5#fixed-in-202657","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.8#fixed-in-202682","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/287ea13cdc23c378abc20a7b71c9c7919a19a89a","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/355d8cc3d755fbba05fc5fa90ffbcbe6469acddd","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/54fac864a0b3bc00551af1908f662b3bf5cc6135","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/984b0162711f0d1988ed33544d0a671c93e4ec76","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25957","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25962","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25967","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25972","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/security/advisories/GHSA-cqj8-fxxf-9pg7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-94613","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:17.723","lastModified":"2026-09-29T03:17:21.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling /application/saml/* or /source/saml/*, causing the requests assigned to that worker to fail. Worker process termination and automatic restart do not destroy database-backed sessions, but continued malicious messages can cause a sustained share of legitimate traffic to fail. Other protocol implementations are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"goauthentik","product":"authentik","versions":[{"version":"< 2026.2.7","status":"affected"},{"version":">= 2026.5.0, < 2026.5.7","status":"affected"},{"version":">= 2026.8.0, < 2026.8.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:53:11.993694Z","id":"CVE-2026-94613","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://docs.goauthentik.io/releases/2026.2#fixed-in-202627","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.5#fixed-in-202657","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.8#fixed-in-202682","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/03d19d63b8d8dd7bc3de7cf6e57c6df341a9fc86","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/4cf2f803b1c2ef38c224eead375fd057a10ee8ac","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/732adad26bb97361b6bf25ef138df5c16471ba1f","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/a029f5372295bfeb1e334855f78601681cdc9a2d","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25959","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25964","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25969","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25974","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/security/advisories/GHSA-cxwx-9x59-28qm","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-97231","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T17:17:18.033","lastModified":"2026-09-29T03:17:22.940","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in volotat Anagnorisis up to 0.3.1/0.4.0. Affected is an unknown function of the file app.py of the component Socket.IO Connect Interface. The manipulation results in missing authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"volotat","product":"Anagnorisis","cpes":["cpe:2.3:a:volotat:anagnorisis:*:*:*:*:*:*:*:*"],"modules":["Socket.IO Connect Interface"],"versions":[{"version":"0.1","status":"affected"},{"version":"0.2","status":"affected"},{"version":"0.3","status":"affected"},{"version":"0.3.0","status":"affected"},{"version":"0.3.1","status":"affected"},{"version":"0.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:55:29.885134Z","id":"CVE-2026-97231","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://note-hxlab.wetolink.com/share/y74Vzt1jfkAi","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97231","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908265","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409321","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409321/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97407","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:18.203","lastModified":"2026-10-03T11:17:52.820","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt\n\nrockchip_pdm_set_fmt() calls pm_runtime_get_sync() before accessing\nhardware registers, but ignores its return value.\nIf the runtime resume fails, the function continues to perform register\naccesses while the device state is undefined.\nReplace pm_runtime_get_sync() with pm_runtime_resume_and_get() and\nreturn early on failure to avoid unpowered register accesses."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/soc/rockchip/rockchip_pdm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c85064435fe7a216ec0f0238ef2b8f7cd850a450","lessThan":"105ea8b7a29b473cbe3aa1e542997700c98e3adc","versionType":"git","status":"affected"},{"version":"c85064435fe7a216ec0f0238ef2b8f7cd850a450","lessThan":"aa48db0257ed4cdb52f922d32872dcc8d201925e","versionType":"git","status":"affected"},{"version":"c85064435fe7a216ec0f0238ef2b8f7cd850a450","lessThan":"52b77346cf66174ab9bc34504729cd686a9e29b1","versionType":"git","status":"affected"},{"version":"c85064435fe7a216ec0f0238ef2b8f7cd850a450","lessThan":"7f0fd754c708785c31b067dd98649e3ec9b8fd72","versionType":"git","status":"affected"},{"version":"c85064435fe7a216ec0f0238ef2b8f7cd850a450","lessThan":"a9cc27a4a9b5fe013e152841fd8408061fa2312f","versionType":"git","status":"affected"},{"version":"c85064435fe7a216ec0f0238ef2b8f7cd850a450","lessThan":"b2b5c2ca5a4924271fa86d75a252de32fa285375","versionType":"git","status":"affected"},{"version":"c85064435fe7a216ec0f0238ef2b8f7cd850a450","lessThan":"ee7b5f7b39332febf917f9ebf212842cc9379815","versionType":"git","status":"affected"},{"version":"a8f82720673d41b85145f232c954fe3a365f72b5","versionType":"git","status":"affected"},{"version":"88294658ddbe0e35fa48e1679252e86b3b5ba1d2","versionType":"git","status":"affected"},{"version":"2f0ec100032e9f23b7561ec6f3b5c8a9806a7100","versionType":"git","status":"affected"},{"version":"4.14.118","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.42","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.0.15","lessThan":"5.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/soc/rockchip/rockchip_pdm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.1","status":"affected"},{"version":"0","lessThan":"5.1","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/105ea8b7a29b473cbe3aa1e542997700c98e3adc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/52b77346cf66174ab9bc34504729cd686a9e29b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f0fd754c708785c31b067dd98649e3ec9b8fd72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a9cc27a4a9b5fe013e152841fd8408061fa2312f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa48db0257ed4cdb52f922d32872dcc8d201925e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2b5c2ca5a4924271fa86d75a252de32fa285375","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee7b5f7b39332febf917f9ebf212842cc9379815","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97408","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:18.337","lastModified":"2026-10-03T11:17:52.943","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: validate connectionless PSM length\n\nConnectionless L2CAP frames carry a two-byte PSM at the start of the\npayload.  l2cap_recv_frame() currently reads that PSM unconditionally\nafter validating only the outer L2CAP length.\n\nA malformed connectionless frame with a zero- or one-byte payload can\ntherefore make the parser read beyond the advertised skb payload and use\ntailroom bytes as part of the PSM.  A VHCI-backed QEMU reproducer\ninjected a one-byte connectionless payload and reached the unchecked\nread.\n\nReject connectionless frames that cannot contain the PSM before reading\nor pulling it.  This preserves all valid connectionless frames while\ndropping only structurally incomplete packets."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8104cd9859b6de0826cffa68adf2c1461185823b","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9448e6f693fcf1f0ac4ee648a9b2cc83bfe4a982","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"22fc1ce4e37c81d4e7aac01566ebdc232214540d","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"72e26293a231f63a856340d3a1f0f5fc29bf87e5","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3502ede8aed3c3ee1786d952a11054ac737d1a38","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"ae69dca122f6d6046a68cf40153e6e827c77ff5c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a40a5f922546b3bd7c094d882b29177db4f2abe0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/22fc1ce4e37c81d4e7aac01566ebdc232214540d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3502ede8aed3c3ee1786d952a11054ac737d1a38","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72e26293a231f63a856340d3a1f0f5fc29bf87e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8104cd9859b6de0826cffa68adf2c1461185823b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9448e6f693fcf1f0ac4ee648a9b2cc83bfe4a982","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a40a5f922546b3bd7c094d882b29177db4f2abe0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae69dca122f6d6046a68cf40153e6e827c77ff5c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97409","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:18.463","lastModified":"2026-10-03T11:17:53.063","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: Do not cancel requests in io target before it is initialized\n\nA new nvme-fc controller in CONNECTING state sees admin request timeout\nschedules ctrl->ioerr_work to abort inflight requests. This ends up\ncalling __nvme_fc_abort_outstanding_ios() which aborts requests in both\nadmin and io tagsets. In case fc_ctrl->tag_set was not initialized we\nsee the warning below. This is because ctrl.queue_count is initialized\nearly in nvme_fc_alloc_ctrl().\n\nnvme nvme0: NVME-FC{0}: starting error recovery Connectivity Loss\nINFO: trying to register non-static key.\nThe code is fine but needs lockdep annotation, or maybe\nlpfc 0000:ab:00.0: queue 0 connect admin queue failed (-6).\nyou didn't initialize this object before use?\nturning off the locking correctness validator.\nWorkqueue: nvme-reset-wq nvme_fc_ctrl_ioerr_work [nvme_fc]\nCall Trace:\n <TASK>\n dump_stack_lvl+0x57/0x80\n register_lock_class+0x567/0x580\n __lock_acquire+0x330/0xb90\n lock_acquire.part.0+0xad/0x210\n blk_mq_tagset_busy_iter+0xf9/0xc00\n __nvme_fc_abort_outstanding_ios+0x23f/0x320 [nvme_fc]\n nvme_fc_ctrl_ioerr_work+0x172/0x210 [nvme_fc]\n process_one_work+0x82c/0x1450\n worker_thread+0x5ee/0xfd0\n kthread+0x3a0/0x750\n ret_from_fork+0x439/0x670\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nUpdate the check in __nvme_fc_abort_outstanding_ios() confirm that io\ntagset was created before iterating over busy requests. Also make sure\nto cancel ctrl->ioerr_work before removing io tagset."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/nvme/host/fc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"52793d62a696e9188092eb0817fb1219ee5729ff","lessThan":"5488e2706c58444a24e15773237dcc0bedcd771f","versionType":"git","status":"affected"},{"version":"52793d62a696e9188092eb0817fb1219ee5729ff","lessThan":"da930308b4bc24c335574e85ca84ff70a988cf05","versionType":"git","status":"affected"},{"version":"52793d62a696e9188092eb0817fb1219ee5729ff","lessThan":"dd39064d2948b14dbe4f364fe4b3c9cfc632cc21","versionType":"git","status":"affected"},{"version":"52793d62a696e9188092eb0817fb1219ee5729ff","lessThan":"ee38469f88492df99e1d97f03aa40ecfd218934f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/nvme/host/fc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/5488e2706c58444a24e15773237dcc0bedcd771f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da930308b4bc24c335574e85ca84ff70a988cf05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd39064d2948b14dbe4f364fe4b3c9cfc632cc21","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee38469f88492df99e1d97f03aa40ecfd218934f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97410","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:18.600","lastModified":"2026-09-25T13:17:24.553","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetconsole: take target_cleanup_list_lock in drop_netconsole_target()\n\ndrop_netconsole_target() unlinks the target while only holding\ntarget_list_lock. However, when the underlying interface has been\nunregistered, netconsole_netdev_event() moves the target from\ntarget_list to target_cleanup_list, and netconsole_process_cleanups_core()\nwalks that list under target_cleanup_list_lock only.\n\nIf a user removes the configfs target at the same time the cleanup\nworker is iterating target_cleanup_list, list_del() can corrupt the list\nbecause the two paths take disjoint locks while operating on the same\nlist node.\n\nAcquire target_cleanup_list_lock around the list_del() so the unlink is\nserialised against netconsole_process_cleanups_core() regardless of\nwhich list the target currently belongs to. The state transition that\ndowngrades STATE_DEACTIVATED to STATE_DISABLED is left intact and is\nperformed under the same combined locking, preserving the existing\nordering with resume_target()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/netconsole.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"97714695ef904a4bdba75ca2f339215c0ae2b1fa","lessThan":"84592ee22f7d1583ce33aa733411ff36c7a1c44c","versionType":"git","status":"affected"},{"version":"97714695ef904a4bdba75ca2f339215c0ae2b1fa","lessThan":"fe8e6c0a2f28bdab14cdf7eff4dd9755d3793007","versionType":"git","status":"affected"},{"version":"97714695ef904a4bdba75ca2f339215c0ae2b1fa","lessThan":"91aeb87f052367a5a2743cc93777dfb4386f2f14","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/netconsole.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/84592ee22f7d1583ce33aa733411ff36c7a1c44c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91aeb87f052367a5a2743cc93777dfb4386f2f14","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe8e6c0a2f28bdab14cdf7eff4dd9755d3793007","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97411","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:18.720","lastModified":"2026-10-03T11:17:53.200","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ibm: emac: mal: fix potential system hang in mal_remove()\n\nnapi_disable() is not idempotent and calling it on an already-disabled\nor unenabled NAPI context will cause the kernel to spin indefinitely\nwaiting for the NAPI_STATE_SCHED bit to clear.\n\nIn mal_remove(), napi_disable() is called unconditionally. If no MACs were\nregistered, NAPI was never enabled. Also, if they were registered but\nsubsequently unregistered, NAPI was already disabled in\nmal_unregister_commac(). In either case, calling napi_disable() causes\nthe kernel to hang upon module removal.\n\nFix this by only calling napi_disable() in mal_remove() if the commac list\nis not empty (which implies NAPI is enabled)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/ibm/emac/mal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b3e441c6ed8655a42e7b4da1b6dc7939f259d9c9","lessThan":"9c1c814a662d9c81959eba591bb52b24639390f2","versionType":"git","status":"affected"},{"version":"b3e441c6ed8655a42e7b4da1b6dc7939f259d9c9","lessThan":"34c4cae51718d6f393415e01c61314c1bde02f2e","versionType":"git","status":"affected"},{"version":"b3e441c6ed8655a42e7b4da1b6dc7939f259d9c9","lessThan":"62126e73e230cf4bd6c27cf201949c4290af84a1","versionType":"git","status":"affected"},{"version":"b3e441c6ed8655a42e7b4da1b6dc7939f259d9c9","lessThan":"f0399b3e212741bc5a64b8399d6266c4a150bdfe","versionType":"git","status":"affected"},{"version":"b3e441c6ed8655a42e7b4da1b6dc7939f259d9c9","lessThan":"f6c1aad9b35fa083f48ce0c5926204891d82e089","versionType":"git","status":"affected"},{"version":"b3e441c6ed8655a42e7b4da1b6dc7939f259d9c9","lessThan":"c4cb9a728df66c46067b26263f5beb633aae4087","versionType":"git","status":"affected"},{"version":"b3e441c6ed8655a42e7b4da1b6dc7939f259d9c9","lessThan":"7c5d41f87f079990bf241359e3c1332d8d10fe87","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/ibm/emac/mal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.24","status":"affected"},{"version":"0","lessThan":"2.6.24","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/34c4cae51718d6f393415e01c61314c1bde02f2e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62126e73e230cf4bd6c27cf201949c4290af84a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c5d41f87f079990bf241359e3c1332d8d10fe87","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c1c814a662d9c81959eba591bb52b24639390f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4cb9a728df66c46067b26263f5beb633aae4087","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0399b3e212741bc5a64b8399d6266c4a150bdfe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f6c1aad9b35fa083f48ce0c5926204891d82e089","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97412","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:18.847","lastModified":"2026-10-21T13:21:09.400","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: quiesce DMA before freeing resources\n\npdsc_teardown() frees DMA buffers but does not disable bus mastering,\nleaving the device able to perform DMA after the buffers are freed.\nThis can lead to use-after-free if the device writes to freed memory.\n\nAdd pci_clear_master() to pdsc_teardown() to disable bus mastering\nbefore freeing resources, ensuring all DMA is quiesced.\n\nAdd pci_set_master() to pdsc_setup() to re-enable bus mastering,\nwhich is needed for the firmware recovery path since pdsc_teardown()\nnow disables it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/amd/pds_core/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"45d76f492938cdc27ddadc16e1e75103f4cfbf56","lessThan":"84fc3f30b87e06a11d1807cd385603522610ed40","versionType":"git","status":"affected"},{"version":"45d76f492938cdc27ddadc16e1e75103f4cfbf56","lessThan":"cc8beb70e70fc90e54efdbc1128cf7de799e6be4","versionType":"git","status":"affected"},{"version":"45d76f492938cdc27ddadc16e1e75103f4cfbf56","lessThan":"9eee6b90bee3df496ed9094d9e76d5e478d72d0a","versionType":"git","status":"affected"},{"version":"45d76f492938cdc27ddadc16e1e75103f4cfbf56","lessThan":"6443f4f20bdae726fe01cf5946fba9742a0ffda6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/amd/pds_core/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6443f4f20bdae726fe01cf5946fba9742a0ffda6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/84fc3f30b87e06a11d1807cd385603522610ed40","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9eee6b90bee3df496ed9094d9e76d5e478d72d0a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc8beb70e70fc90e54efdbc1128cf7de799e6be4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97413","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:18.990","lastModified":"2026-10-03T11:17:53.320","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Fix integer underflow in process_read and process_write\n\nusr_len is read from a network-supplied message field (le16_to_cpu)\nand used to compute data_len = off - usr_len without validating that\nusr_len <= off. A malicious RDMA client can send usr_len > off causing\nan integer underflow, resulting in data_len wrapping to a huge size_t\nvalue which is then passed to the rdma_ev callback as a memory length,\nleading to out-of-bounds memory access.\n\nFix by reading and validating usr_len <= off before rtrs_srv_get_ops_ids()\nin both process_read() and process_write(), ensuring the early return\npath acquires no reference and has no resource leak."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/ulp/rtrs/rtrs-srv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"6b1e26e70d7ca9f0906af2283558a530eeb1f066","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"2c52b2afded988233cd4ccc185cf5147bbc77a76","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"b042b4947752df0b3d16e683ac09fb4f7f0e33e0","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"24ad03bfeda05fca04c56677e57fd3d6bc3e9978","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"c76e9123ab91a903396d26e6ab1b5caae5c6b149","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/ulp/rtrs/rtrs-srv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/24ad03bfeda05fca04c56677e57fd3d6bc3e9978","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c52b2afded988233cd4ccc185cf5147bbc77a76","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b1e26e70d7ca9f0906af2283558a530eeb1f066","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b042b4947752df0b3d16e683ac09fb4f7f0e33e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c76e9123ab91a903396d26e6ab1b5caae5c6b149","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97414","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.103","lastModified":"2026-09-25T13:17:24.943","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend()\n\nmt8365_afe_suspend() allocates the register backup buffer with\ndevm_kcalloc(), but does not check for allocation failure before using the\nreturned pointer. This may lead to a NULL pointer dereference when\naccessing afe->reg_back_up[i].\n\nAdd the missing NULL check and return -ENOMEM on allocation failure after\ndisabling the main clock.\n\nAlso propagate the return value of mt8365_afe_suspend() in\nmt8365_afe_dev_runtime_suspend() so that the suspended state is not updated\nwhen suspend fails."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/soc/mediatek/mt8365/mt8365-afe-pcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e1991d102bc2abb32331c462f8f3e77059c69578","lessThan":"f87707bc0406fe92bc142a9eee5f480c94ce9ff8","versionType":"git","status":"affected"},{"version":"e1991d102bc2abb32331c462f8f3e77059c69578","lessThan":"1094d83ad325829acd68e63147793536060a0d60","versionType":"git","status":"affected"},{"version":"e1991d102bc2abb32331c462f8f3e77059c69578","lessThan":"b8948ac26efc395264a47f9a743889065adb5cff","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/soc/mediatek/mt8365/mt8365-afe-pcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1094d83ad325829acd68e63147793536060a0d60","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8948ac26efc395264a47f9a743889065adb5cff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f87707bc0406fe92bc142a9eee5f480c94ce9ff8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97415","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.223","lastModified":"2026-10-03T11:17:53.457","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF\n\nROOT_REF and ROOT_BACKREF items contain a struct btrfs_root_ref followed\nby the subvolume name. Several readers assume that this layout is already\nvalid and then use the on-disk name length directly. A corrupted item can\ntherefore make those readers address bytes outside the item, and\nBTRFS_IOC_GET_SUBVOL_INFO can copy too many bytes into its fixed-size UAPI\nname buffer.\n\nValidate ROOT_REF and ROOT_BACKREF items in tree-checker before any reader\nuses them. Reject records that do not contain a non-empty name, whose\nname_len does not exactly describe the remaining item payload, or whose\nname exceeds BTRFS_NAME_LEN.\n\nFor BTRFS_IOC_GET_SUBVOL_INFO, copy only the validated on-disk name_len\ninstead of deriving the copy length from the item size. The ioctl result is\nzeroed when allocated. That leaves the existing trailing zero byte\nuntouched."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/ioctl.c","fs/btrfs/tree-checker.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b64ec075bded2b30bcd90af5aa5256d2237c885d","lessThan":"1370badf6b823ce3cde39a65f46f9e5dc7b4bf43","versionType":"git","status":"affected"},{"version":"b64ec075bded2b30bcd90af5aa5256d2237c885d","lessThan":"ba6c4fc662853f6662e4db060cf88ee994053e21","versionType":"git","status":"affected"},{"version":"b64ec075bded2b30bcd90af5aa5256d2237c885d","lessThan":"9154542070ca7eadb3c764a882f39a127677854b","versionType":"git","status":"affected"},{"version":"b64ec075bded2b30bcd90af5aa5256d2237c885d","lessThan":"74f577c722c99248d804eca18e7de7c5e47549d7","versionType":"git","status":"affected"},{"version":"b64ec075bded2b30bcd90af5aa5256d2237c885d","lessThan":"0af37c217edf15fa21dac1c40822086df356c6bb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/ioctl.c","fs/btrfs/tree-checker.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.18","status":"affected"},{"version":"0","lessThan":"4.18","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0af37c217edf15fa21dac1c40822086df356c6bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1370badf6b823ce3cde39a65f46f9e5dc7b4bf43","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74f577c722c99248d804eca18e7de7c5e47549d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9154542070ca7eadb3c764a882f39a127677854b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba6c4fc662853f6662e4db060cf88ee994053e21","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97416","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.340","lastModified":"2026-10-03T11:17:53.617","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()\n\n[BUG]\nRunning btrfs balance can trigger a null-ptr-deref before relocating a\ndata chunk when metadata corruption leaves a chunk in the chunk tree\nwithout a corresponding block group in the in-memory cache:\n\n  KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f]\n  RIP: 0010:btrfs_may_alloc_data_chunk+0x40/0x1c0 fs/btrfs/volumes.c:3601\n  Call Trace:\n    __btrfs_balance fs/btrfs/volumes.c:4217 [inline]\n    btrfs_balance+0x2516/0x42b0 fs/btrfs/volumes.c:4604\n    btrfs_ioctl_balance fs/btrfs/ioctl.c:3577 [inline]\n    btrfs_ioctl+0x25cf/0x5b90 fs/btrfs/ioctl.c:5313\n    ...\n\n[CAUSE]\n__btrfs_balance() iterates the on-disk chunk tree and passes the chunk\nlogical bytenr to btrfs_may_alloc_data_chunk() before relocating a data\nchunk. That helper then queries the in-memory block group cache:\n\n  cache = btrfs_lookup_block_group(fs_info, chunk_offset);\n  chunk_type = cache->flags;   /* cache may be NULL */\n\nA corrupt image can contain a chunk item whose matching block group\nitem is missing, so no block group is ever inserted into the cache. In\nthat case btrfs_lookup_block_group() returns NULL.\n\nThe code only guards this with ASSERT(cache), which becomes a no-op when\nCONFIG_BTRFS_ASSERT is disabled. The subsequent dereference of\ncache->flags therefore crashes the kernel.\n\n[FIX]\nAdd a NULL check after btrfs_lookup_block_group() in\nbtrfs_may_alloc_data_chunk() and print and error message for clarity."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/volumes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a6f93c71d412ba8ed743152c3a54ad0b78dcd9c7","lessThan":"9f37a6d6ae9e998232e2ba091ab4999cdf967e1b","versionType":"git","status":"affected"},{"version":"a6f93c71d412ba8ed743152c3a54ad0b78dcd9c7","lessThan":"e479236a8f4d85c4fb6b3f7c2556c21f583e2bf2","versionType":"git","status":"affected"},{"version":"a6f93c71d412ba8ed743152c3a54ad0b78dcd9c7","lessThan":"322f891b4d4fe64acb3351a0ffa62a7fa5ba7256","versionType":"git","status":"affected"},{"version":"a6f93c71d412ba8ed743152c3a54ad0b78dcd9c7","lessThan":"81a664ed8b1a44c76b204c4bd0d751317a02c5cd","versionType":"git","status":"affected"},{"version":"a6f93c71d412ba8ed743152c3a54ad0b78dcd9c7","lessThan":"9740dd0c17a4be8cc47a06c5ca5293471a7e286e","versionType":"git","status":"affected"},{"version":"a6f93c71d412ba8ed743152c3a54ad0b78dcd9c7","lessThan":"59f75e0c8724d4adebc08c7dd3ff2358b80c21f7","versionType":"git","status":"affected"},{"version":"a6f93c71d412ba8ed743152c3a54ad0b78dcd9c7","lessThan":"18d32b0013efba19f7ad3e5b08d7aee813d604a6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/volumes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/18d32b0013efba19f7ad3e5b08d7aee813d604a6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/322f891b4d4fe64acb3351a0ffa62a7fa5ba7256","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59f75e0c8724d4adebc08c7dd3ff2358b80c21f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81a664ed8b1a44c76b204c4bd0d751317a02c5cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9740dd0c17a4be8cc47a06c5ca5293471a7e286e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f37a6d6ae9e998232e2ba091ab4999cdf967e1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e479236a8f4d85c4fb6b3f7c2556c21f583e2bf2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97417","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.457","lastModified":"2026-10-03T11:17:53.747","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()\n\nThe timestamp-only fast path dereferences the option stream as\n*(__be32 *)ptr, which assumes 4-byte alignment that the TCP option\nstream does not guarantee. Use get_unaligned_be32() instead, which\nreads the value safely and already returns host byte order, so the\nhtonl() on the comparison constant can be dropped.\n\nThis matches the existing get_unaligned_be32() use later in the same\nfunction."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nf_conntrack_proto_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9","lessThan":"740ad3d17a281f7764dda4dbeb37cea52e2e31ae","versionType":"git","status":"affected"},{"version":"bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9","lessThan":"a0523267de2523522b0f70972dd1ffa22ec6176c","versionType":"git","status":"affected"},{"version":"bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9","lessThan":"55bcc3376cd7b18954cc9814da697504fdaf12bf","versionType":"git","status":"affected"},{"version":"bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9","lessThan":"0d5ad732e4fdc569eb85861115e8f7b4c2c67852","versionType":"git","status":"affected"},{"version":"bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9","lessThan":"7ecfa46a536578a7ed335ddf31a854127268c27c","versionType":"git","status":"affected"},{"version":"bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9","lessThan":"4abc1af7ac209c066f4e5dd75cdd56876e5829a9","versionType":"git","status":"affected"},{"version":"bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9","lessThan":"d3bf9eae486490832bd08fd62ab0ac601f346bd4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/nf_conntrack_proto_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.1","status":"affected"},{"version":"0","lessThan":"3.1","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/0d5ad732e4fdc569eb85861115e8f7b4c2c67852","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4abc1af7ac209c066f4e5dd75cdd56876e5829a9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55bcc3376cd7b18954cc9814da697504fdaf12bf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/740ad3d17a281f7764dda4dbeb37cea52e2e31ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ecfa46a536578a7ed335ddf31a854127268c27c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0523267de2523522b0f70972dd1ffa22ec6176c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3bf9eae486490832bd08fd62ab0ac601f346bd4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97418","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.613","lastModified":"2026-10-03T11:17:53.883","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: es18xx: check control allocation before private data setup\n\nsnd_es18xx_mixer() creates controls with snd_ctl_new1() and then stores\nbookkeeping pointers or sets private_free before calling snd_ctl_add().\nsnd_ctl_new1() can return NULL on allocation failure, so those writes\ncan dereference a NULL control pointer.\n\nCheck the returned control pointers before using them and return -ENOMEM\non allocation failure."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/isa/es18xx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e6c84fe4cf6f98f7b1ad446a42cfcb46bae83f66","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"908323ed61d5e7ad74889524d327cfb6a65ec8df","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3d8adddf4e4a5a43847ee62e5e78ba05e756bdef","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"91c97a7969dae976de954453ab6e925e6522fecb","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"978079238f40f1a08ddb12ce208c484246f6a1b0","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d88c24b76f285df9d206751e22c28e2613258cb3","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"422e42b7c2b882ba1d16d4afc8891bcea7c4de93","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/isa/es18xx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3d8adddf4e4a5a43847ee62e5e78ba05e756bdef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/422e42b7c2b882ba1d16d4afc8891bcea7c4de93","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/908323ed61d5e7ad74889524d327cfb6a65ec8df","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91c97a7969dae976de954453ab6e925e6522fecb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/978079238f40f1a08ddb12ce208c484246f6a1b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d88c24b76f285df9d206751e22c28e2613258cb3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6c84fe4cf6f98f7b1ad446a42cfcb46bae83f66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97419","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.733","lastModified":"2026-10-03T11:17:54.000","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhsr: broadcast netlink notifications in the device's net namespace\n\nThe HSR generic netlink family sets .netnsok = true. HSR devices can\nlive in network namespaces other than init_net.\n\nTwo async notifiers broadcast events with genlmsg_multicast(). They\nare hsr_nl_ringerror() and hsr_nl_nodedown(). That helper delivers\nonly on the default genl socket in init_net. So the events always land\nin init_net. The network namespace of the device does not matter.\n\nThis has two effects. A listener in the device's own namespace never\nsees its own ring error and node down events. A privileged listener in\ninit_net receives events from HSR devices in other namespaces. The\npayload carries the peer node MAC (HSR_A_NODE_ADDR) and the slave port\nifindex (HSR_A_IFINDEX).\n\nSwitch both callers to genlmsg_multicast_netns(). Other families with\n.netnsok = true already do this. Examples are gtp, ovpn, team,\nbatman-adv, netdev-genl, ethtool and handshake.\n\nhsr_nl_ringerror() already has the slave port. It uses\ndev_net(port->dev). hsr_nl_nodedown() takes the namespace from the\nmaster port via hsr_port_get_hsr()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/hsr/hsr_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f421436a591d34fa5279b54a96ac07d70250cc8d","lessThan":"9f13023607f1e95bd098cc49052b0c8955d334f9","versionType":"git","status":"affected"},{"version":"f421436a591d34fa5279b54a96ac07d70250cc8d","lessThan":"798ccb12810a58a37264685b28ddf990ef49559c","versionType":"git","status":"affected"},{"version":"f421436a591d34fa5279b54a96ac07d70250cc8d","lessThan":"9bf45feee630be868ab54e3d0f3d430c07471f0e","versionType":"git","status":"affected"},{"version":"f421436a591d34fa5279b54a96ac07d70250cc8d","lessThan":"016b8eaca53bfd57e84ea28b5c9174c89d7679e1","versionType":"git","status":"affected"},{"version":"f421436a591d34fa5279b54a96ac07d70250cc8d","lessThan":"25b69f281cebe051a8e4ab19950a939c27ead1bc","versionType":"git","status":"affected"},{"version":"f421436a591d34fa5279b54a96ac07d70250cc8d","lessThan":"24b3f1a9982c176d05a523a4bb9314dca0db4488","versionType":"git","status":"affected"},{"version":"f421436a591d34fa5279b54a96ac07d70250cc8d","lessThan":"a762fabd7ef9a6cc07258684138f9c3f078d0326","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/hsr/hsr_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.13","status":"affected"},{"version":"0","lessThan":"3.13","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/016b8eaca53bfd57e84ea28b5c9174c89d7679e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/24b3f1a9982c176d05a523a4bb9314dca0db4488","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/25b69f281cebe051a8e4ab19950a939c27ead1bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/798ccb12810a58a37264685b28ddf990ef49559c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9bf45feee630be868ab54e3d0f3d430c07471f0e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f13023607f1e95bd098cc49052b0c8955d334f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a762fabd7ef9a6cc07258684138f9c3f078d0326","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97420","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.853","lastModified":"2026-10-03T11:17:54.123","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: NUL-terminate replaced sysctl value\n\nWhen writing to sysctls, proc_sys_call_handler() guarantees that the\nbuffer passed to proc handlers is NUL-terminated. If\nbpf_sysctl_set_new_value() replaces the pending sysctl value, it can\nhand a replacement buffer directly to proc handlers. However, the\nhelper currently copies only buf_len bytes into that buffer without\nappending a NUL terminator, leaving downstream parsers vulnerable to\nout-of-bounds access.\n\nFix this by appending a '\\0' after the replaced value to restore the\nexpected sysctl semantics. Since the helper already rejects buf_len\ngreater than PAGE_SIZE - 1, there is always room for the extra byte.\n\nReproduced in a QEMU x86_64 guest booted with KASAN while exercising\nthe sysctl replacement path with a cgroup/sysctl BPF program. The\nreproducer targets `/proc/sys/net/core/flow_limit_cpu_bitmap`, fills\nthe original user write buffer with non-zero bytes, and overrides the\nsysctl value so the replacement buffer lacks a terminating NUL. Under\nthat setup, the pre-fix kernel reported:\n\n  BUG: KASAN: slab-out-of-bounds in strnchrnul+0x72/0x90\n  Read of size 1 at addr ffff88800de57000 by task repro_patch3/66\n  CPU: 0 UID: 0 PID: 66 Comm: repro_patch3 Not tainted 7.1.0-rc3-00269-g8370ca1f87cc #6 PREEMPT(lazy)\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x68/0xa0\n   print_report+0xcb/0x5e0\n   ? __virt_addr_valid+0x21d/0x3f0\n   ? strnchrnul+0x72/0x90\n   ? strnchrnul+0x72/0x90\n   kasan_report+0xca/0x100\n   ? strnchrnul+0x72/0x90\n   strnchrnul+0x72/0x90\n   bitmap_parse+0x37/0x2e0\n   flow_limit_cpu_sysctl+0xc6/0x840\n   ? __pfx_flow_limit_cpu_sysctl+0x10/0x10\n   ? __kvmalloc_node_noprof+0x5ba/0x870\n   proc_sys_call_handler+0x31d/0x480\n   ? __pfx_proc_sys_call_handler+0x10/0x10\n   ? selinux_file_permission+0x39f/0x500\n   ? lock_is_held_type+0x9e/0x120\n   vfs_write+0x98e/0x1000\n   ...\n   </TASK>\n  The buggy address is located 0 bytes to the right of\n  allocated 4096-byte region [ffff88800de56000, ffff88800de57000)\nWith this fix applied, rerunning the same sysctl-targeted path yields\nno corresponding KASAN reports."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/cgroup.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"32927393dc1ccd60fb2bdc05b9e8e88753761469","lessThan":"bfcee1f79aaefa90679ad47690107fb7682724ec","versionType":"git","status":"affected"},{"version":"32927393dc1ccd60fb2bdc05b9e8e88753761469","lessThan":"c73e4a04eedc677fe91a736d7a5db45100adba5e","versionType":"git","status":"affected"},{"version":"32927393dc1ccd60fb2bdc05b9e8e88753761469","lessThan":"36d3e9f62dc2beb9299d3bb6f589cb9e07f773fe","versionType":"git","status":"affected"},{"version":"32927393dc1ccd60fb2bdc05b9e8e88753761469","lessThan":"31377675c3d75603d957c08e338a9ac27e9f6cd5","versionType":"git","status":"affected"},{"version":"32927393dc1ccd60fb2bdc05b9e8e88753761469","lessThan":"76c14b10f50eb0afcc76e244562fa2d8c661e224","versionType":"git","status":"affected"},{"version":"32927393dc1ccd60fb2bdc05b9e8e88753761469","lessThan":"3b2814dd842a565fcf9cc370156e1ba9eae16239","versionType":"git","status":"affected"},{"version":"32927393dc1ccd60fb2bdc05b9e8e88753761469","lessThan":"a66e3b5bacf38d6ab29fa05a9754f7a114485605","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/cgroup.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/31377675c3d75603d957c08e338a9ac27e9f6cd5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/36d3e9f62dc2beb9299d3bb6f589cb9e07f773fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b2814dd842a565fcf9cc370156e1ba9eae16239","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/76c14b10f50eb0afcc76e244562fa2d8c661e224","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a66e3b5bacf38d6ab29fa05a9754f7a114485605","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfcee1f79aaefa90679ad47690107fb7682724ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c73e4a04eedc677fe91a736d7a5db45100adba5e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97421","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.993","lastModified":"2026-10-03T11:17:54.257","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()\n\nSeveral corner cases, especially important on 32 bits:\n\n- umem->iova is u64, the function argument should pass in u64 or\n  iova will be truncated\n- Check that the length is not too large for the iova\n- Check that lengths > 4G don't overflow the GENMASK"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/core/umem.c","include/rdma/ib_umem.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"3014da7587ce006cd08004fd6b257626b314e0a3","versionType":"git","status":"affected"},{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"ddccf6cc3861de2fe60986933bead79220e0d797","versionType":"git","status":"affected"},{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"e9bbb5f5349ef560ff6f0395564f04c3aa664559","versionType":"git","status":"affected"},{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"ae3cf7d2c4d506c5c91746321644e1a08d989e2a","versionType":"git","status":"affected"},{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"5fc5b73109540809b094710fac44da81dd8a3ff8","versionType":"git","status":"affected"},{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"09ea6837a0434fb4db99528a5055b6d822135dcf","versionType":"git","status":"affected"},{"version":"85e40ba1c4a5246b35e91c2ed69d4680426904d7","versionType":"git","status":"affected"},{"version":"59f07434b297e2268f5d5c567db5b09145245cf1","versionType":"git","status":"affected"},{"version":"488229b7729d7becf4c39c5e74fb709fb35115c2","versionType":"git","status":"affected"},{"version":"5.4.73","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.8.17","lessThan":"5.9","versionType":"semver","status":"affected"},{"version":"5.9.2","lessThan":"5.10","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/core/umem.c","include/rdma/ib_umem.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/09ea6837a0434fb4db99528a5055b6d822135dcf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3014da7587ce006cd08004fd6b257626b314e0a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5fc5b73109540809b094710fac44da81dd8a3ff8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae3cf7d2c4d506c5c91746321644e1a08d989e2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ddccf6cc3861de2fe60986933bead79220e0d797","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9bbb5f5349ef560ff6f0395564f04c3aa664559","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97422","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.113","lastModified":"2026-10-21T13:21:09.520","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix SMI event cross-process information leak\n\nkfd_smi_ev_enabled() skips the suser privilege check when pid=0.\nPROCESS_START, PROCESS_END, and VMFAULT events are emitted with\npid=0 while carrying another process's PID and command name, so any\n/dev/kfd user in the render group can monitor all GPU workloads.\n\nPass the target process PID into kfd_smi_event_add() for these events\nso the existing per-client filter restricts delivery to the owning\nprocess or CAP_SYS_ADMIN subscribers."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"938a0650aae6275ba8e924685836bdee2c6aa3db","lessThan":"6fc7ab7fcd7eefb2f371a1d43cf7a860a08f922a","versionType":"git","status":"affected"},{"version":"938a0650aae6275ba8e924685836bdee2c6aa3db","lessThan":"470319a893f616ef661a63e825a8e1b9b6eddb91","versionType":"git","status":"affected"},{"version":"938a0650aae6275ba8e924685836bdee2c6aa3db","lessThan":"5bb2dfa65d8da83e87b2a31c270bc567df69a5ca","versionType":"git","status":"affected"},{"version":"938a0650aae6275ba8e924685836bdee2c6aa3db","lessThan":"92a8dba246d371fe268280e5fd74b0955688e6df","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.9","status":"affected"},{"version":"0","lessThan":"5.9","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/470319a893f616ef661a63e825a8e1b9b6eddb91","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5bb2dfa65d8da83e87b2a31c270bc567df69a5ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fc7ab7fcd7eefb2f371a1d43cf7a860a08f922a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/92a8dba246d371fe268280e5fd74b0955688e6df","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97423","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.227","lastModified":"2026-09-25T13:17:25.867","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/region: Validate partition index before array access\n\nconstruct_region() reads cxled->part and uses it to index\ncxlds->part[] without checking for a negative value. If the\npartition was never resolved, part remains at its initial value\nof -1, causing an out-of-bounds array access.\n\nAdd a guard to return -EBUSY when part is negative.\n\nThe check was dropped during a merge."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/cxl/core/region.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b6faa9c613787b894913638a76030018f6d62d54","lessThan":"06322da06116f1ee52271dd4d84dc69580087df7","versionType":"git","status":"affected"},{"version":"b6faa9c613787b894913638a76030018f6d62d54","lessThan":"16329b510f76e5b824e05bf8add8b29850f1f16f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/cxl/core/region.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/06322da06116f1ee52271dd4d84dc69580087df7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/16329b510f76e5b824e05bf8add8b29850f1f16f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97424","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.340","lastModified":"2026-10-21T13:21:09.637","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq\n\ncp_ecc_error_irq is acquired in amdgpu_gfx_ras_late_init() but\nreleased in gfx_v9_0_hw_fini(), so the put site has to query\namdgpu_irq_enabled() because the get is skipped on SR-IOV VF.\n\nras_late_init / ras_fini have no suspend counterpart, so move the\nput to amdgpu_gfx_ras_suspend() / amdgpu_gfx_ras_fini() and add a\nmatching ras_suspend callback that is invoked from\namdgpu_ras_suspend() before disable_all_features().  The get and\nput now sit in the same place and check the same condition (not\nVF, funcs registered), no refcount querying needed.\n\nAn active flag gates ras_fini so the\nsuspend-then-unload-without-resume path falls into\namdgpu_ras_block_late_fini_default() instead of double-releasing\nwhat ras_suspend already cleaned up.\n\nDrop the cp_ecc_error_irq put from gfx_v9_0_hw_fini().  gfx_v8_0\nmanages cp_ecc_error_irq locally and is unaffected; no other GFX\ngeneration has this IRQ."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c","drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h","drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c","drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h","drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"760a1d55344d823287850466db893ed77e948803","lessThan":"c1f2f34d681a0b354e1218b83245d1f2d2139a8d","versionType":"git","status":"affected"},{"version":"760a1d55344d823287850466db893ed77e948803","lessThan":"5b761927dbb170df4716d9c0ef85e178a1856e64","versionType":"git","status":"affected"},{"version":"760a1d55344d823287850466db893ed77e948803","lessThan":"001824103f2fe6ffd2380afddf81f43b446035b2","versionType":"git","status":"affected"},{"version":"760a1d55344d823287850466db893ed77e948803","lessThan":"e3829992dd9fa0a82511af4f01733fc854cd15a5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c","drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h","drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c","drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h","drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.2","status":"affected"},{"version":"0","lessThan":"5.2","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/001824103f2fe6ffd2380afddf81f43b446035b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5b761927dbb170df4716d9c0ef85e178a1856e64","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c1f2f34d681a0b354e1218b83245d1f2d2139a8d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3829992dd9fa0a82511af4f01733fc854cd15a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97425","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.450","lastModified":"2026-10-03T11:17:54.400","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix buffer overflow during vBIOS update\n\nClamp the buffer postion to write by setting the bin attribute\nto the maximum buffer size so that VFS layer will block the\nout-of-bounds accessing."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8424f2ccb3c0dd43369288a47d15c980136c3bd5","lessThan":"4a1b0a4c5acbe96368d71157b264dcd917ba6c9e","versionType":"git","status":"affected"},{"version":"8424f2ccb3c0dd43369288a47d15c980136c3bd5","lessThan":"c7b2af01ee2ecfb8f2289dc83524d8fb1ec72992","versionType":"git","status":"affected"},{"version":"8424f2ccb3c0dd43369288a47d15c980136c3bd5","lessThan":"29fef371331e87311822000535f491ffc3d7a64f","versionType":"git","status":"affected"},{"version":"8424f2ccb3c0dd43369288a47d15c980136c3bd5","lessThan":"6229898d46c0cbc238a6fe9f11c1ea12cf8bb9c5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/29fef371331e87311822000535f491ffc3d7a64f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a1b0a4c5acbe96368d71157b264dcd917ba6c9e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6229898d46c0cbc238a6fe9f11c1ea12cf8bb9c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c7b2af01ee2ecfb8f2289dc83524d8fb1ec72992","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97426","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.570","lastModified":"2026-09-25T13:17:26.150","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error\n\nReturn the parse error before acquiring PM access."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/pm/amdgpu_pm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"55aa33c3fe38763e4f285d5192fb9892133360a7","lessThan":"95e13b25196295654563028861e6802807006ad4","versionType":"git","status":"affected"},{"version":"55aa33c3fe38763e4f285d5192fb9892133360a7","lessThan":"a4b0c3f5d2287997876d8f711a40d3c0418458d8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/pm/amdgpu_pm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/95e13b25196295654563028861e6802807006ad4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4b0c3f5d2287997876d8f711a40d3c0418458d8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97427","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.680","lastModified":"2026-10-03T11:17:54.500","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: bound pp_dpm_set_pp_table() memcpy\n\nThe powerplay path allocates hardcode_pp_table once with kmemdup(...,\nsoft_pp_table_size). memcpy(..., size) used the sysfs store count (up to\nPAGE_SIZE) with no upper bound, causing heap overflow. Reject\nwrites where size exceeds soft_pp_table_size."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b9c1a77e8cd73aa42c2736b6b0ffddda6230af1a","lessThan":"abe61d067b48b947bedc9bae3725cb8f48dc8c0a","versionType":"git","status":"affected"},{"version":"b9c1a77e8cd73aa42c2736b6b0ffddda6230af1a","lessThan":"9b5cb2e4eb297fe52be26fd895fc5ea28fc22bf9","versionType":"git","status":"affected"},{"version":"b9c1a77e8cd73aa42c2736b6b0ffddda6230af1a","lessThan":"43d2ab8408f9f468b232350c74160ae21e763020","versionType":"git","status":"affected"},{"version":"b9c1a77e8cd73aa42c2736b6b0ffddda6230af1a","lessThan":"3334985f8b4c7c637a829744c81518ad9a671bcb","versionType":"git","status":"affected"},{"version":"b9c1a77e8cd73aa42c2736b6b0ffddda6230af1a","lessThan":"f193e71fa9fab2e68ef85201b106e8f580d3a25b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.6","status":"affected"},{"version":"0","lessThan":"4.6","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3334985f8b4c7c637a829744c81518ad9a671bcb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/43d2ab8408f9f468b232350c74160ae21e763020","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b5cb2e4eb297fe52be26fd895fc5ea28fc22bf9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/abe61d067b48b947bedc9bae3725cb8f48dc8c0a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f193e71fa9fab2e68ef85201b106e8f580d3a25b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97428","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.797","lastModified":"2026-10-21T13:21:09.770","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: harden FRU PIA parsing with bounded helpers\n\nReplace the open-coded TLV walk with fru_pia_advance()\nand fru_pia_copy_field() helpers that bound every read\nby the actual EEPROM data length, preventing out-of-bounds\nreads on truncated or malformed FRU data."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0dbf2c56262532fbd498f590c91c4085413b8829","lessThan":"567d7c3f93f8d6bdc946a557a160ee1c42cfae91","versionType":"git","status":"affected"},{"version":"0dbf2c56262532fbd498f590c91c4085413b8829","lessThan":"813311512505e95e4e3c898ff94b11886a15e494","versionType":"git","status":"affected"},{"version":"0dbf2c56262532fbd498f590c91c4085413b8829","lessThan":"4396d74b0c7304946ee343a6611ac6dbc0bfbf78","versionType":"git","status":"affected"},{"version":"0dbf2c56262532fbd498f590c91c4085413b8829","lessThan":"c990c05eb6c74c98d1ff3acf67a19015312820b7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/4396d74b0c7304946ee343a6611ac6dbc0bfbf78","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/567d7c3f93f8d6bdc946a557a160ee1c42cfae91","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/813311512505e95e4e3c898ff94b11886a15e494","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c990c05eb6c74c98d1ff3acf67a19015312820b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97429","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.907","lastModified":"2026-10-03T11:17:54.607","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix UAF race in destroy_queue_cpsch\n\nwait_on_destroy_queue() drops locks to wait for queue resume, allowing\na concurrent destroy to free the queue. Use is_being_destroyed flag to\nserialize destruction."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a70a93fa568b4f05aba548dadb673703eccf5480","lessThan":"090b51e2dabf88c02c0b6b25ea672a8bddfba7d5","versionType":"git","status":"affected"},{"version":"a70a93fa568b4f05aba548dadb673703eccf5480","lessThan":"41144829f4645c2bd4cb501d34d253858f750c0a","versionType":"git","status":"affected"},{"version":"a70a93fa568b4f05aba548dadb673703eccf5480","lessThan":"d98c8032c29944e1e572e1f49a0613d364fece0f","versionType":"git","status":"affected"},{"version":"a70a93fa568b4f05aba548dadb673703eccf5480","lessThan":"ac081deaf16a639ea7dff2f285fe421a33c1ade0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/090b51e2dabf88c02c0b6b25ea672a8bddfba7d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41144829f4645c2bd4cb501d34d253858f750c0a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac081deaf16a639ea7dff2f285fe421a33c1ade0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d98c8032c29944e1e572e1f49a0613d364fece0f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97430","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.017","lastModified":"2026-10-03T11:17:54.737","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: Prevent queuing new commands if xhci is inaccessible\n\nRefuse to queue a new command on the command ring if xHC is marked\ninaccessible with the HCD_FLAG_HW_ACCESSIBLE.\n\nHCD_FLAG_HW_ACCESSIBLE is set and cleared in suspend and resume.\n\nAlso print a warning if xhci is being suspended with commands\nstill pending on the command ring."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/host/xhci-ring.c","drivers/usb/host/xhci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5535b1d5f8885695c6ded783c692e3c0d0eda8ca","lessThan":"0e2eaa000e4e5ad46b7cf8fcf1e4a2585ef8b5a8","versionType":"git","status":"affected"},{"version":"5535b1d5f8885695c6ded783c692e3c0d0eda8ca","lessThan":"add3aeb74e2c7d82fa1035af2a027666c6906210","versionType":"git","status":"affected"},{"version":"5535b1d5f8885695c6ded783c692e3c0d0eda8ca","lessThan":"a215190ef68ca3602fe00674e0efffad71beb3aa","versionType":"git","status":"affected"},{"version":"5535b1d5f8885695c6ded783c692e3c0d0eda8ca","lessThan":"fec259e46d44317379834a44115fae66122dc93f","versionType":"git","status":"affected"},{"version":"5535b1d5f8885695c6ded783c692e3c0d0eda8ca","lessThan":"a50948386256b24d73971b9a152fe1de808446ab","versionType":"git","status":"affected"},{"version":"5535b1d5f8885695c6ded783c692e3c0d0eda8ca","lessThan":"a05e54c1eeaba10414aa2fde94589a7c9885f2a1","versionType":"git","status":"affected"},{"version":"5535b1d5f8885695c6ded783c692e3c0d0eda8ca","lessThan":"82b70c799281cc24506085be978b829149ba0ca4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/host/xhci-ring.c","drivers/usb/host/xhci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.37","status":"affected"},{"version":"0","lessThan":"2.6.37","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0e2eaa000e4e5ad46b7cf8fcf1e4a2585ef8b5a8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/82b70c799281cc24506085be978b829149ba0ca4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a05e54c1eeaba10414aa2fde94589a7c9885f2a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a215190ef68ca3602fe00674e0efffad71beb3aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a50948386256b24d73971b9a152fe1de808446ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/add3aeb74e2c7d82fa1035af2a027666c6906210","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fec259e46d44317379834a44115fae66122dc93f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97431","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.123","lastModified":"2026-09-25T13:17:26.733","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Avoid DPMS-on for phantom stream\n\n[Why & How]\nCalling dc_update_planes_and_stream separately for stream and its\nphantom stream causes a NULL pointer dereference, since the phantom is\ndestroyed on the first call.\n\nSkip the call for phantom streams."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9c6669c2e21a2d9b3f3857883c715a302ae64ac0","lessThan":"f2463fc246d3c39be1371389c52b29418ad673d0","versionType":"git","status":"affected"},{"version":"9c6669c2e21a2d9b3f3857883c715a302ae64ac0","lessThan":"10f5f9c0ef32d08b228bfee3684b62f36f395852","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/10f5f9c0ef32d08b228bfee3684b62f36f395852","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2463fc246d3c39be1371389c52b29418ad673d0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97432","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.237","lastModified":"2026-10-21T13:21:09.923","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix P2P-Device binding handling\n\nOur binding handling for P2P-Device can run into the following\nscenario, as observed by our testing:\n\n - a station interface is connected on some channel\n - the P2P-Device does a remain-on-channel (ROC) on that channel\n - the ROC ends, and the P2P-Device is removed from the binding,\n   but the phy_ctxt pointer is left around as a PHY cache so we\n   don't need to recalibrate to the channel again and again in\n   case it's not shared\n - a binding update by the station interface, even a removal,\n   will re-add the P2P-Device to the binding\n - the P2P-Device is removed, which removes the PHY context, but\n   it's still in the binding so the firmware crashes\n\nSince the P2P device is removed from the binding and only re-\nadded by unrelated code, but we want to keep the phy_ctxt around\nas a cache for future ROC usage, fix it by adding a boolean that\nindicates whether or not the P2P-Device should be added to the\nbinding, and handle that in the binding iterator. That way, the\nstation interface cannot re-add the P2P-Device to the binding\nwhen that isn't active."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/binding.c","drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c","drivers/net/wireless/intel/iwlwifi/mvm/mvm.h","drivers/net/wireless/intel/iwlwifi/mvm/time-event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"64c277f6329818db3124c9759cb9acf0f6070a54","lessThan":"50bf37362362c8f03ab1aeab866b7fb08b262204","versionType":"git","status":"affected"},{"version":"84ef7cbe90e9e54c71c1da4e645ba34e1b33da77","lessThan":"8575514a979490c9d4517fcf19b4e19119c27702","versionType":"git","status":"affected"},{"version":"84ef7cbe90e9e54c71c1da4e645ba34e1b33da77","lessThan":"7be2fc679c8f657868988e41c0bb15bf5a454620","versionType":"git","status":"affected"},{"version":"84ef7cbe90e9e54c71c1da4e645ba34e1b33da77","lessThan":"b74e377cad9271950c57472867c469e4b5b2ff0c","versionType":"git","status":"affected"},{"version":"8ddf2212cfa5d9ef4fd289ce0d9dda728f2160b8","versionType":"git","status":"affected"},{"version":"6.6.2","lessThan":"6.6.160","versionType":"semver","status":"affected"},{"version":"6.5.12","lessThan":"6.6","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/binding.c","drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c","drivers/net/wireless/intel/iwlwifi/mvm/mvm.h","drivers/net/wireless/intel/iwlwifi/mvm/time-event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/50bf37362362c8f03ab1aeab866b7fb08b262204","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7be2fc679c8f657868988e41c0bb15bf5a454620","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8575514a979490c9d4517fcf19b4e19119c27702","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b74e377cad9271950c57472867c469e4b5b2ff0c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97433","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.350","lastModified":"2026-09-25T13:17:26.930","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: validate FDP configuration descriptor sizes\n\nValidate descriptor sizes while walking the FDP configurations log so\ndsze == 0 or a descriptor past the log end cannot cause unbounded\niteration or reads past the buffer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/nvme/host/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"30b5f20bb2ddab013035399e5c7e6577da49320a","lessThan":"97efd7a41aac08b43ea2337c5913a2bc75484f9f","versionType":"git","status":"affected"},{"version":"30b5f20bb2ddab013035399e5c7e6577da49320a","lessThan":"0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/nvme/host/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}]},"references":[{"url":"https://git.kernel.org/stable/c/0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97efd7a41aac08b43ea2337c5913a2bc75484f9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97434","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.453","lastModified":"2026-10-03T11:17:54.850","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: fix handling of NAPI on the remove path\n\nAll the NAPI instances for a DPSW device are attached to the first\nswitch port's net_device but shared by all ports. The NAPI instances get\ndisabled only once the last port goes down.\n\nThis causes an issue on the .remove() path where each port is\nunregistered and freed one at a time, causing the NAPI instances to be\ndeleted even though they are not disabled.\n\nIn order to avoid this, split up the unregister_netdev() calls from the\nfree_netdev() so that we make sure all ports go down before we attempt\na deletion of NAPI instances. Also, make the netif_napi_del() explicit\nas it is on the .probe() path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0b1b71370458860579831e77485883fcf2e8fbbe","lessThan":"d39603e21087e9ef9cd125e5895cdc70b2eb154d","versionType":"git","status":"affected"},{"version":"0b1b71370458860579831e77485883fcf2e8fbbe","lessThan":"bd16f46d0796109d241d6311a7577f9956467c96","versionType":"git","status":"affected"},{"version":"0b1b71370458860579831e77485883fcf2e8fbbe","lessThan":"c996faba71fc465ad12c6d177bd1a9ad974f9ee8","versionType":"git","status":"affected"},{"version":"0b1b71370458860579831e77485883fcf2e8fbbe","lessThan":"569df157eb874cb3b50554d73b89f31599397b42","versionType":"git","status":"affected"},{"version":"0b1b71370458860579831e77485883fcf2e8fbbe","lessThan":"6518f87771c8833e587bd9881346fa759651c2ae","versionType":"git","status":"affected"},{"version":"0b1b71370458860579831e77485883fcf2e8fbbe","lessThan":"e23d7c8c1d4ba435c457d7ffb2669175ec819b07","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/569df157eb874cb3b50554d73b89f31599397b42","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6518f87771c8833e587bd9881346fa759651c2ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd16f46d0796109d241d6311a7577f9956467c96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c996faba71fc465ad12c6d177bd1a9ad974f9ee8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d39603e21087e9ef9cd125e5895cdc70b2eb154d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e23d7c8c1d4ba435c457d7ffb2669175ec819b07","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97435","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.573","lastModified":"2026-10-03T11:17:54.967","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: sja1105: flower: reject cross-chip redirect\n\ndsa_port_from_netdev() may return a valid port from a different switch\nchip. Programming another chip's port index into the local hardware\ncauses redirection to the wrong port, or an out-of-bounds access if the\nindex exceeds the local chip's port count.\n\nApply a minimal fix that adds a check to catch this case and adjusts the\nextack message. When cls->common.skip_sw is not set, the operation could\ninstead redirect to the upstream port and let the software or upstream\nswitch(es) handle the forward, but that is not addressed here."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/dsa/sja1105/sja1105_flower.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"dfacc5a23e227cabdff41b6202f510398e90d36b","lessThan":"6bf5158af52a5293e9160d8f2992c629ca14aa7d","versionType":"git","status":"affected"},{"version":"dfacc5a23e227cabdff41b6202f510398e90d36b","lessThan":"277f8611e017d3ff1ab06af58a6c538b55da1cc8","versionType":"git","status":"affected"},{"version":"dfacc5a23e227cabdff41b6202f510398e90d36b","lessThan":"eb177aa00c392de3dc530c34f173a962216f82dd","versionType":"git","status":"affected"},{"version":"dfacc5a23e227cabdff41b6202f510398e90d36b","lessThan":"d0e54098c072b6064cdcf8039075ada8b88583da","versionType":"git","status":"affected"},{"version":"dfacc5a23e227cabdff41b6202f510398e90d36b","lessThan":"c999cc39775381b68ed66eae57c1425452672c0f","versionType":"git","status":"affected"},{"version":"dfacc5a23e227cabdff41b6202f510398e90d36b","lessThan":"abd7511e12b231798332afa04ed9bee9e84f9445","versionType":"git","status":"affected"},{"version":"dfacc5a23e227cabdff41b6202f510398e90d36b","lessThan":"cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/dsa/sja1105/sja1105_flower.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/277f8611e017d3ff1ab06af58a6c538b55da1cc8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6bf5158af52a5293e9160d8f2992c629ca14aa7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/abd7511e12b231798332afa04ed9bee9e84f9445","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c999cc39775381b68ed66eae57c1425452672c0f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0e54098c072b6064cdcf8039075ada8b88583da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb177aa00c392de3dc530c34f173a962216f82dd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97436","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.697","lastModified":"2026-10-03T11:17:55.083","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: rework FDB management on the bridge leave path\n\nOn bridge leave, the dpaa2_switch_port_set_fdb() function always\nallocates a new FDB for the port which is becoming standalone. In case\nno FDB is found, then the port leaving a bridge will continue to use the\ncurrent one.\n\nThe above logic does not cover the case in which there are multiple\nbridges which have ports from the same DPSW instance. In this case, when\nthe last port leaves bridge #1, it finds an unused FDB to switch to, but\nthe old FDB is not marked as unused. Since the number of FDBs is equal\nto the number of DPSW interfaces, this will eventually lead to multiple\nports sharing the same FDB.\n\nFix this by changing how we are managing the FDBs on the leave path.\nInstead of directly allocating a new FDB, first verify if the current\nport is the last one to leave a bridge. If this is the case, then\ncontinue to use the current FDB and only allocate another FDB if there\nare other ports remaining in the bridge."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"539dda3c5d190c5088b5e57944b1b482fcb464de","lessThan":"ec41bfd281a8bc8027a42d2674eac5b74947ff7a","versionType":"git","status":"affected"},{"version":"539dda3c5d190c5088b5e57944b1b482fcb464de","lessThan":"e07ff2338f45adbf572850335d761c2f97545935","versionType":"git","status":"affected"},{"version":"539dda3c5d190c5088b5e57944b1b482fcb464de","lessThan":"dc626f2abb3052881911b6166a9425739ce80085","versionType":"git","status":"affected"},{"version":"539dda3c5d190c5088b5e57944b1b482fcb464de","lessThan":"abea361a11e4e48695ea149652ef5d3f308b6a49","versionType":"git","status":"affected"},{"version":"539dda3c5d190c5088b5e57944b1b482fcb464de","lessThan":"5adbc4d02d7df8bd7aa02c21874f7a582a576b55","versionType":"git","status":"affected"},{"version":"539dda3c5d190c5088b5e57944b1b482fcb464de","lessThan":"efc1d92eacf03afa6f4d53bf7120e059b6f961f2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5adbc4d02d7df8bd7aa02c21874f7a582a576b55","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/abea361a11e4e48695ea149652ef5d3f308b6a49","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc626f2abb3052881911b6166a9425739ce80085","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e07ff2338f45adbf572850335d761c2f97545935","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ec41bfd281a8bc8027a42d2674eac5b74947ff7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/efc1d92eacf03afa6f4d53bf7120e059b6f961f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97437","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.810","lastModified":"2026-10-03T11:17:55.200","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()\n\nThe bounds check in ntfs_dir_emit() compares fname->name_len (a\ncharacter count) against e->size (a byte count) without accounting\nfor the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME\nheader size:\n\n  if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size))\n\nThis computes: name_len + 16 > e_size\n\nThe correct check must account for the ATTR_FILE_NAME header (66 bytes\nbefore the name) and the UTF-16LE character size (2 bytes each):\n\n  sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, name) +\n  name_len * sizeof(short) > e_size\n\nWhich computes: 16 + 66 + name_len * 2 > e_size\n\nThe correct calculation already exists as fname_full_size() in ntfs.h\nand is used in cmp_fnames(), namei.c, and fslog.c, but was not used\nin the readdir path.\n\nA crafted NTFS image with an index entry containing a small e->size\nbut large fname->name_len bypasses the current check, causing\nntfs_utf16_to_nls() to read past the entry boundary.\n\nAdditionally, add a key_size validation in hdr_find_e() to ensure the\ndeclared key_size does not exceed the available entry data, preventing\ncomparison functions from reading past entry boundaries on the lookup\npath."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs3/dir.c","fs/ntfs3/index.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"d1f98938e437732c0ecdfc8ee451e12a072f6d07","versionType":"git","status":"affected"},{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"0505f1e7bb5b981b6ed62d98b26ddce76142865d","versionType":"git","status":"affected"},{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"2f7d0ec8c10dc7bf7a8c9a9cb169f9a4d1fac2ba","versionType":"git","status":"affected"},{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"ed6da1abeec50db9060d714f03743fe0b63e4fe4","versionType":"git","status":"affected"},{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"6a8149a20e46086c756c2a9202e377c0b649a0c3","versionType":"git","status":"affected"},{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"aa1bdbb39f49c5bc9779316891c40005517842a5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs3/dir.c","fs/ntfs3/index.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/0505f1e7bb5b981b6ed62d98b26ddce76142865d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2f7d0ec8c10dc7bf7a8c9a9cb169f9a4d1fac2ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6a8149a20e46086c756c2a9202e377c0b649a0c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa1bdbb39f49c5bc9779316891c40005517842a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1f98938e437732c0ecdfc8ee451e12a072f6d07","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed6da1abeec50db9060d714f03743fe0b63e4fe4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97438","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.930","lastModified":"2026-10-03T11:17:55.350","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate index entry key bounds\n\n[BUG]\nA malformed NTFS directory index entry can advertise a key_size larger\nthan the bytes actually present in its NTFS_DE payload. Directory lookup\nthen passes that malformed key to cmp_fnames(), which can read past the\nend of the kmalloc'ed index buffer.\n\nBUG: KASAN: slab-out-of-bounds in fname_full_size fs/ntfs3/ntfs.h:590 [inline]\nBUG: KASAN: slab-out-of-bounds in cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46\nRead of size 1 at addr ffff88801c313018 by task syz.6.3365/9279\n\nCall Trace:\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xd1/0x650 mm/kasan/report.c:482\n kasan_report+0xfb/0x140 mm/kasan/report.c:595\n __asan_report_load1_noabort+0x14/0x30 mm/kasan/report_generic.c:378\n fname_full_size fs/ntfs3/ntfs.h:590 [inline]\n cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46\n hdr_find_e.isra.0+0x3ed/0x670 fs/ntfs3/index.c:762\n indx_find+0x4b5/0x900 fs/ntfs3/index.c:1186\n dir_search_u+0x2c0/0x460 fs/ntfs3/dir.c:254\n ntfs_lookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85\n __lookup_slow+0x241/0x450 fs/namei.c:1816\n lookup_slow fs/namei.c:1833 [inline]\n walk_component+0x31c/0x570 fs/namei.c:2151\n link_path_walk+0x592/0xd60 fs/namei.c:2519\n path_lookupat+0x138/0x660 fs/namei.c:2675\n filename_lookup+0x1f3/0x560 fs/namei.c:2705\n filename_setxattr+0xad/0x1c0 fs/xattr.c:660\n path_setxattrat+0x1d8/0x280 fs/xattr.c:713\n __do_sys_lsetxattr fs/xattr.c:754 [inline]\n __se_sys_lsetxattr fs/xattr.c:750 [inline]\n __x64_sys_lsetxattr+0xd0/0x150 fs/xattr.c:750\n ...\n\nAllocated by task 9279:\n kasan_save_stack+0x39/0x70 mm/kasan/common.c:56\n kasan_save_track+0x14/0x40 mm/kasan/common.c:77\n kasan_save_alloc_info+0x37/0x60 mm/kasan/generic.c:573\n poison_kmalloc_redzone mm/kasan/common.c:400 [inline]\n __kasan_kmalloc+0xc3/0xd0 mm/kasan/common.c:417\n kasan_kmalloc include/linux/kasan.h:262 [inline]\n __do_kmalloc_node mm/slub.c:5650 [inline]\n __kmalloc_noprof+0x2bd/0x900 mm/slub.c:5662\n kmalloc_noprof include/linux/slab.h:961 [inline]\n indx_read+0x41d/0xad0 fs/ntfs3/index.c:1059\n indx_find+0x447/0x900 fs/ntfs3/index.c:1179\n dir_search_u+0x2c0/0x460 fs/ntfs3/dir.c:254\n ntfs_lookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85\n __lookup_slow+0x241/0x450 fs/namei.c:1816\n lookup_slow fs/namei.c:1833 [inline]\n walk_component+0x31c/0x570 fs/namei.c:2151\n link_path_walk+0x592/0xd60 fs/namei.c:2519\n path_lookupat+0x138/0x660 fs/namei.c:2675\n filename_lookup+0x1f3/0x560 fs/namei.c:2705\n filename_setxattr+0xad/0x1c0 fs/xattr.c:660\n path_setxattrat+0x1d8/0x280 fs/xattr.c:713\n __do_sys_lsetxattr fs/xattr.c:754 [inline]\n __se_sys_lsetxattr fs/xattr.c:750 [inline]\n __x64_sys_lsetxattr+0xd0/0x150 fs/xattr.c:750\n ...\n\n[CAUSE]\nThe index-header validators only validated INDEX_HDR-level geometry.\nThey did not walk each NTFS_DE to verify entry alignment, subnode\nlayout, or that key_size fit inside the entry payload. They also\nallowed a last sentinel entry to carry a non-zero key_size.\n\n[FIX]\nWalk every NTFS_DE in ntfs3's index-header validators and reject\nentries with invalid layout, mismatched subnode state, oversized\nkey_size, or non-zero sentinel keys before lookup or log replay can\nconsume them."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs3/fslog.c","fs/ntfs3/index.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","lessThan":"c8d93bc4823baecab3c39b877e16ac5f8d4d41ba","versionType":"git","status":"affected"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","lessThan":"7feeb424bda7f6ffaf5090cdd01b300eaa74c02b","versionType":"git","status":"affected"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","lessThan":"d564a885219a655077eefafeb72395a4580ebd69","versionType":"git","status":"affected"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","lessThan":"a8f4fb6a7d58974ffc9aed597401528b181d76dc","versionType":"git","status":"affected"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","lessThan":"0257e3ea00e19129f3ad5c039d8b8fdff0796835","versionType":"git","status":"affected"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","lessThan":"98d6e5d9dc1d34dcffc61549617581a5fe1ef807","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs3/fslog.c","fs/ntfs3/index.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/0257e3ea00e19129f3ad5c039d8b8fdff0796835","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7feeb424bda7f6ffaf5090cdd01b300eaa74c02b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98d6e5d9dc1d34dcffc61549617581a5fe1ef807","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8f4fb6a7d58974ffc9aed597401528b181d76dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c8d93bc4823baecab3c39b877e16ac5f8d4d41ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d564a885219a655077eefafeb72395a4580ebd69","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97439","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.073","lastModified":"2026-10-03T11:17:55.520","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib\n\n[BUG]\nA corrupted ntfs3 image can hit a NULL function pointer call in\ngeneric_perform_write() after toggling system.ntfs_attrib and then\noverwriting system.dos_attrib on the same file.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n\\#PF: supervisor instruction fetch in kernel mode\n\\#PF: error_code(0x0010) - not-present page\nPGD bed5067 P4D bed5067 PUD 0\nOops: Oops: 0010 [#1] SMP KASAN NOPTI\nRIP: 0010:0x0\nCode: Unable to access opcode bytes at 0xffffffffffffffd6.\nRSP: 0018:ffff88801025f988 EFLAGS: 00010246\nCall Trace:\n generic_perform_write+0x409/0x8c0 mm/filemap.c:4255\n __generic_file_write_iter+0x1bb/0x200 mm/filemap.c:4372\n ntfs_file_write_iter+0xcd9/0x1c20 fs/ntfs3/file.c:1253\n new_sync_write fs/read_write.c:593 [inline]\n vfs_write+0x63b/0xf70 fs/read_write.c:686\n ksys_write+0x133/0x250 fs/read_write.c:738\n __do_sys_write fs/read_write.c:749 [inline]\n __se_sys_write fs/read_write.c:746 [inline]\n __x64_sys_write+0x77/0xc0 fs/read_write.c:746\n ...\n\n[CAUSE]\nsystem.ntfs_attrib updates ATTR_DATA flags via ni_new_attr_flags()\nand switches i_mapping->a_ops to ntfs_aops_cmpr when\nFILE_ATTRIBUTE_COMPRESSED is set. system.dos_attrib then overwrites\nni->std_fa from a one-byte DOS attribute value, clearing the compression\nbit without updating ATTR_DATA or the mapping operations.\n\nOld buffered writes use is_compressed(ni) to choose\n__generic_file_write_iter(). That leaves generic_perform_write() calling\na NULL write_begin callback from ntfs_aops_cmpr.\n\n[FIX]\nTreat system.dos_attrib as a low-byte DOS attribute update and preserve the\nexisting non-DOS attribute bits in ni->std_fa. This keeps compressed and\nsparse state consistent with ATTR_DATA and the mapping operations while\nkeeping the existing DOS attribute semantics intact."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs3/xattr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"be71b5cba2e6485e8959da7a9f9a44461a1bb074","lessThan":"533217b90addd57cc16f1c974e023c72d18949c7","versionType":"git","status":"affected"},{"version":"be71b5cba2e6485e8959da7a9f9a44461a1bb074","lessThan":"f2d6bc89e2236939df189831707c8cdad199f57a","versionType":"git","status":"affected"},{"version":"be71b5cba2e6485e8959da7a9f9a44461a1bb074","lessThan":"fdc9f65aa6631df04238c6154713bacd5133d77c","versionType":"git","status":"affected"},{"version":"be71b5cba2e6485e8959da7a9f9a44461a1bb074","lessThan":"2de91ae285b0b878604d2bd83c3c395a8071e482","versionType":"git","status":"affected"},{"version":"be71b5cba2e6485e8959da7a9f9a44461a1bb074","lessThan":"407ee19828a7d9700969ed9cc53be50d0f533619","versionType":"git","status":"affected"},{"version":"be71b5cba2e6485e8959da7a9f9a44461a1bb074","lessThan":"b1c1101067d9536bcb0fe023b96ee2dde5535959","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs3/xattr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2de91ae285b0b878604d2bd83c3c395a8071e482","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/407ee19828a7d9700969ed9cc53be50d0f533619","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/533217b90addd57cc16f1c974e023c72d18949c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1c1101067d9536bcb0fe023b96ee2dde5535959","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2d6bc89e2236939df189831707c8cdad199f57a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fdc9f65aa6631df04238c6154713bacd5133d77c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97440","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.197","lastModified":"2026-10-03T11:17:55.643","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix node refcount leak on ctrl packet alloc failure\n\nqrtr_send_resume_tx() calls qrtr_node_lookup() which takes a\nreference on the returned node. If the subsequent call to\nqrtr_alloc_ctrl_packet() fails due to memory allocation failure, the\nfunction returns -ENOMEM without calling qrtr_node_release() to\nrelease the node reference.\n\nAdd qrtr_node_release(node) before returning on the allocation failure\npath to properly release the reference."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/qrtr/af_qrtr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cb6530b99fafea6c0636c4640bd21301d12cdbc9","lessThan":"78d066ecac9ce50441d4affae0df2093c4c3e62e","versionType":"git","status":"affected"},{"version":"cb6530b99fafea6c0636c4640bd21301d12cdbc9","lessThan":"f3e90fbcd2d5ec1632bc2e8cdd1218f56bcb5fcf","versionType":"git","status":"affected"},{"version":"cb6530b99fafea6c0636c4640bd21301d12cdbc9","lessThan":"c3515740174b778d0ee44acc477b51a6478da6b8","versionType":"git","status":"affected"},{"version":"cb6530b99fafea6c0636c4640bd21301d12cdbc9","lessThan":"f76a39c45182d9137e053081cee9f2c197404ce6","versionType":"git","status":"affected"},{"version":"cb6530b99fafea6c0636c4640bd21301d12cdbc9","lessThan":"477353db343663d5502ca442c6de785d2f23f273","versionType":"git","status":"affected"},{"version":"cb6530b99fafea6c0636c4640bd21301d12cdbc9","lessThan":"9d969c98732a4d42212ec580dd5bbad53f246103","versionType":"git","status":"affected"},{"version":"cb6530b99fafea6c0636c4640bd21301d12cdbc9","lessThan":"3b09ff54114566864eea59020f6b69c5bb325b9d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/qrtr/af_qrtr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3b09ff54114566864eea59020f6b69c5bb325b9d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/477353db343663d5502ca442c6de785d2f23f273","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78d066ecac9ce50441d4affae0df2093c4c3e62e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d969c98732a4d42212ec580dd5bbad53f246103","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3515740174b778d0ee44acc477b51a6478da6b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f3e90fbcd2d5ec1632bc2e8cdd1218f56bcb5fcf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f76a39c45182d9137e053081cee9f2c197404ce6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97441","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.313","lastModified":"2026-10-03T11:17:55.757","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nata: ahci: fail probe if BAR too small for claimed ports\n\nWhen an AHCI controller is disabled in BIOS, its HOST_CAP register may\ncontain a bogus value, e.g. 0xFFFFFFFF.\n\nSince CAP.NP (Number of Ports) is a zeroes based 5-bit register field,\na value of 0x1f means 32 ports. If CAP.NP claims more ports than can\nphysically fit within the mapped BAR region, accessing port registers\nbeyond the BAR boundary causes a kernel panic.\n\nAdd validation in ahci_init_one() to check that the BAR size is\nsufficient for the number of ports claimed in CAP.NP. The check\ncalculates the required MMIO size as:\n\n  required_size = 0x100 (global registers) + max_ports * 0x80\n\nIf required_size exceeds the actual BAR size, the probe fails with\n-ENODEV, preventing the panic and providing a clear error message.\n\n[cassel: commit log]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/ata/ahci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"533a08ea11217100cec7a0ed903cb9b9c892d6f1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c717b20100ef8cd06b5237af70ea2cb692e058ce","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"ff0ab535f8febbd32afa5832f8d2d9b06a8d5060","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6d29b91164424256a759ddabc8f2de1ae09bd3f1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"df262c828b616450eb351349e91c63447551bd01","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f2e291043c37a896d7f9797e25a356dceb030177","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c4086c6e1af757e1ff26fa2d2926b3ec0195de79","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/ata/ahci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/533a08ea11217100cec7a0ed903cb9b9c892d6f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d29b91164424256a759ddabc8f2de1ae09bd3f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4086c6e1af757e1ff26fa2d2926b3ec0195de79","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c717b20100ef8cd06b5237af70ea2cb692e058ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df262c828b616450eb351349e91c63447551bd01","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2e291043c37a896d7f9797e25a356dceb030177","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff0ab535f8febbd32afa5832f8d2d9b06a8d5060","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97442","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.433","lastModified":"2026-10-03T11:17:55.873","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi\n\nIn certain cases, hardware might provide packets with a\nlength greater than the maximum native Wi-Fi header length.\nThis can lead to accessing and modifying fields in the header\nwithin the ath11k_dp_rx_h_undecap_nwifi() function for the\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type and\npotentially result in invalid data access and memory corruption.\n\nKernel stack is corrupted in: ath11k_dp_rx_h_undecap+0x6b0/0x6b0 [ath11k]\nCall trace:\n ath11k_dp_rx_h_mpdu+0x0/0x2e8 [ath11k]\n ath11k_dp_rx_h_mpdu+0x1e0/0x2e8 [ath11k]\n ath11k_dp_rx_wbm_err+0x1e0/0x450 [ath11k]\n ath11k_dp_rx_process_wbm_err+0x2fc/0x460 [ath11k]\n ath11k_dp_service_srng+0x2e0/0x348 [ath11k]\n\nAdd a sanity check before processing the SKB to prevent invalid\ndata access in the undecap native Wi-Fi function for the\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type.\n\nThis adapted from the discussion/patch of the ath12k driver [1].\n\nTested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"acc79d981c1462b22a7a2cb0d39725f8c01fc425","lessThan":"958cf3696ddc5ccafd3d0b8b0c03d90bcd771c0c","versionType":"git","status":"affected"},{"version":"acc79d981c1462b22a7a2cb0d39725f8c01fc425","lessThan":"b4ef30f1d107aae460edf731a7c2d187fbc46a32","versionType":"git","status":"affected"},{"version":"acc79d981c1462b22a7a2cb0d39725f8c01fc425","lessThan":"1c0a13be76db3c1cf774aa11d9f4c3f8239ac567","versionType":"git","status":"affected"},{"version":"acc79d981c1462b22a7a2cb0d39725f8c01fc425","lessThan":"00738665c875ab34efa7126ea63c9d70b48ee169","versionType":"git","status":"affected"},{"version":"acc79d981c1462b22a7a2cb0d39725f8c01fc425","lessThan":"6b471e9aefee9ed73278eb1141e0d8530a56fae9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/00738665c875ab34efa7126ea63c9d70b48ee169","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1c0a13be76db3c1cf774aa11d9f4c3f8239ac567","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b471e9aefee9ed73278eb1141e0d8530a56fae9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/958cf3696ddc5ccafd3d0b8b0c03d90bcd771c0c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b4ef30f1d107aae460edf731a7c2d187fbc46a32","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97443","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.550","lastModified":"2026-09-25T13:17:28.023","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/ftrace: Fix WARNING in __unregister_ftrace_function\n\nperf_ftrace_function_unregister() unconditionally calls\nunregister_ftrace_function() without checking whether the ftrace_ops\nwas ever successfully registered. This triggers a WARN_ON in\n__unregister_ftrace_function() when the ops doesn't have\nFTRACE_OPS_FL_ENABLED set.\n\nThis can happen during perf_event_alloc() error cleanup when\nperf_trace_destroy() is called via __free_event() on an event whose\nftrace_ops registration failed or was already torn down by\nperf_try_init_event()'s err_destroy path.\n\nThe call path is:\n  perf_event_alloc() error cleanup\n    -> __free_event()\n      -> event->destroy() [tp_perf_event_destroy]\n        -> perf_trace_destroy()\n          -> perf_trace_event_close()\n            -> TRACE_REG_PERF_CLOSE\n              -> perf_ftrace_function_unregister()\n                -> unregister_ftrace_function()\n                  -> __unregister_ftrace_function()\n                    -> WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED))\n\nFix this by checking FTRACE_OPS_FL_ENABLED before attempting to\nunregister. If the ops is not enabled, just free the filter and\nreturn success."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_event_perf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7ef5aa081f989ecfecc1df02068a80aebbd3ec31","lessThan":"df097713b56ffac5eed32a9be2e7d27ac48d9087","versionType":"git","status":"affected"},{"version":"c70ca298036c58a88686ff388d3d367e9d21acf0","lessThan":"7f845820afaad339341c2ae42bc7fdec175df9ea","versionType":"git","status":"affected"},{"version":"c70ca298036c58a88686ff388d3d367e9d21acf0","lessThan":"9581123304b23049437324038698af9fb56ee663","versionType":"git","status":"affected"},{"version":"315a50c6b1c6ce191f19f3372935d8e2ed9b53a6","versionType":"git","status":"affected"},{"version":"1209b0b29fd472e7dbd2b06544b019dd9f9b7e51","versionType":"git","status":"affected"},{"version":"6.12.24","lessThan":"6.12.111","versionType":"semver","status":"affected"},{"version":"6.13.12","lessThan":"6.14","versionType":"semver","status":"affected"},{"version":"6.14.3","lessThan":"6.15","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_event_perf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/7f845820afaad339341c2ae42bc7fdec175df9ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9581123304b23049437324038698af9fb56ee663","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df097713b56ffac5eed32a9be2e7d27ac48d9087","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97444","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.663","lastModified":"2026-10-03T11:17:56.017","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: add boundary checks in two places\n\nAdd boundary checks in acpi_ps_get_next_namestring() and\nacpi_ps_peek_opcode() to prevent out-of-bounds access."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/psargs.c","drivers/acpi/acpica/psparse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3a8c1efc0fd3abb2d2b1254315f36db03abc88eb","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c917df56b73719a2d4cee1c4ab4a6626acb95315","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4f03d84c95a51436878cd750a14f8ca37eeb3112","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"38ee32a9ace6fae8965f059b38e6e7fb27b1e7ce","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"253d7272d01db9529c79b95205c0f859ef9f4f23","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4de2cffef5e6b5b79eec8c934df582459b818228","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"bdc35754012906dbf094be104b103ca3adfef6f7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/psargs.c","drivers/acpi/acpica/psparse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/253d7272d01db9529c79b95205c0f859ef9f4f23","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38ee32a9ace6fae8965f059b38e6e7fb27b1e7ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3a8c1efc0fd3abb2d2b1254315f36db03abc88eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4de2cffef5e6b5b79eec8c934df582459b818228","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4f03d84c95a51436878cd750a14f8ca37eeb3112","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bdc35754012906dbf094be104b103ca3adfef6f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c917df56b73719a2d4cee1c4ab4a6626acb95315","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97445","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.773","lastModified":"2026-10-03T11:17:56.153","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()\n\nEnhance buffer validation in acpi_ut_walk_aml_resources() to prevent\nbuffer overflows."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/utresrc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"816badec122fe01d05265f2d306212739f5d3fdb","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"cd60a407a3a6d75347a04f9271b7b561d06d21c8","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"37c794f87a72471f7ef71633ac0550ad14ac0885","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"50a11e2f3dc8a7189e7ebbd3eeafa51f16128a56","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f65e2ef7ccca11dc874f48aff996a6a26528f8e7","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d0fb1973f705c8b8bd7e118e4a9a65d05d800fba","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b2e21fe8c3361c3d0d57ee56d359bea9b51fda3d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/utresrc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/37c794f87a72471f7ef71633ac0550ad14ac0885","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/50a11e2f3dc8a7189e7ebbd3eeafa51f16128a56","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/816badec122fe01d05265f2d306212739f5d3fdb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2e21fe8c3361c3d0d57ee56d359bea9b51fda3d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cd60a407a3a6d75347a04f9271b7b561d06d21c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0fb1973f705c8b8bd7e118e4a9a65d05d800fba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f65e2ef7ccca11dc874f48aff996a6a26528f8e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97446","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.880","lastModified":"2026-10-03T11:17:56.300","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()\n\nacpi_ns_custom_package() unconditionally dereferences the first element\nof the package to read the _BIX version number, without checking for\nNULL:\n\n    if ((*Elements)->Common.Type != ACPI_TYPE_INTEGER)\n\nWhen firmware returns a _BIX package whose first element is an\nunresolvable reference, ACPICA evaluates that entry to NULL.\nacpi_ns_remove_null_elements() does not strip NULL entries for\nACPI_PTYPE_CUSTOM packages (fixed-position format would break if\nelements were shifted), so acpi_ns_custom_package() sees the NULL\nand causes a crash.\n\nAdd a NULL check for the first element (version field) before\ndereferencing it. The caller then receives AE_AML_OPERAND_TYPE\ninstead of crashing."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/nsprepkg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7952d40240855932de01bbe81c02bf1416ec91d8","lessThan":"fad537538cdfcdc51e41db61bbf9ebe5ed9427eb","versionType":"git","status":"affected"},{"version":"7952d40240855932de01bbe81c02bf1416ec91d8","lessThan":"9936507ac0f2379787a2a805b11ab1cf0f241372","versionType":"git","status":"affected"},{"version":"7952d40240855932de01bbe81c02bf1416ec91d8","lessThan":"644888605f55395e6012ed43e3ed643ef7ab5013","versionType":"git","status":"affected"},{"version":"7952d40240855932de01bbe81c02bf1416ec91d8","lessThan":"08c5dee5da1d8d99b5a4e94db5a3d873c491771e","versionType":"git","status":"affected"},{"version":"7952d40240855932de01bbe81c02bf1416ec91d8","lessThan":"3762c6c8ae5073892d7cec736cc54270c7c9ce90","versionType":"git","status":"affected"},{"version":"7952d40240855932de01bbe81c02bf1416ec91d8","lessThan":"3cbf096a478f4fa03953f0685ad28c9c82ce67cb","versionType":"git","status":"affected"},{"version":"7952d40240855932de01bbe81c02bf1416ec91d8","lessThan":"f8d14b7bb0063bbbd86c0e4d73edb8cea7b362bc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/nsprepkg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/08c5dee5da1d8d99b5a4e94db5a3d873c491771e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3762c6c8ae5073892d7cec736cc54270c7c9ce90","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3cbf096a478f4fa03953f0685ad28c9c82ce67cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/644888605f55395e6012ed43e3ed643ef7ab5013","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9936507ac0f2379787a2a805b11ab1cf0f241372","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8d14b7bb0063bbbd86c0e4d73edb8cea7b362bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fad537538cdfcdc51e41db61bbf9ebe5ed9427eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97447","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.993","lastModified":"2026-09-25T13:17:28.510","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()\n\nEnhance OEM ID and Table ID validation in acpi_ex_load_table_op() to\nprevent buffer overflows."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/exconfig.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ebf27765421c9238b7835d32a95e4a7fb8db26a4","lessThan":"d15c574022e0944f651759f567a9eef61e7b93ca","versionType":"git","status":"affected"},{"version":"ebf27765421c9238b7835d32a95e4a7fb8db26a4","lessThan":"485829e6999b7909f50761a1c708660304edc945","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/exconfig.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/485829e6999b7909f50761a1c708660304edc945","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d15c574022e0944f651759f567a9eef61e7b93ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97448","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.110","lastModified":"2026-10-03T11:17:56.417","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Add validation for node in acpi_ns_build_normalized_path()\n\nAdd validation for node in acpi_ns_build_normalized_path()\nto prevent use-after-free vulnerabilities."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/nsnames.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d1e7ffe50ba588ddf7de520990815c37f31776d8","lessThan":"087eed8b347e14864f8806fa1f5976c7dc2c6792","versionType":"git","status":"affected"},{"version":"d1e7ffe50ba588ddf7de520990815c37f31776d8","lessThan":"b06bb9b82c8f9a522dde213b1e0ddd535f22e3a2","versionType":"git","status":"affected"},{"version":"d1e7ffe50ba588ddf7de520990815c37f31776d8","lessThan":"90ebe7f8bb6ca1c6eadb16bed141ab8bb3dbab70","versionType":"git","status":"affected"},{"version":"d1e7ffe50ba588ddf7de520990815c37f31776d8","lessThan":"26dd27000e9540fcb594f15010b0696b03b0d240","versionType":"git","status":"affected"},{"version":"d1e7ffe50ba588ddf7de520990815c37f31776d8","lessThan":"babb146ceb79e71f328788f1e2c8c7c224026e61","versionType":"git","status":"affected"},{"version":"d1e7ffe50ba588ddf7de520990815c37f31776d8","lessThan":"21a73528579fcbd673b668bd27a05b658123bc1b","versionType":"git","status":"affected"},{"version":"d1e7ffe50ba588ddf7de520990815c37f31776d8","lessThan":"96b2b616870e46e2bc04efec03879683a0036e66","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/nsnames.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.3","status":"affected"},{"version":"0","lessThan":"4.3","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/087eed8b347e14864f8806fa1f5976c7dc2c6792","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/21a73528579fcbd673b668bd27a05b658123bc1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/26dd27000e9540fcb594f15010b0696b03b0d240","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/90ebe7f8bb6ca1c6eadb16bed141ab8bb3dbab70","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96b2b616870e46e2bc04efec03879683a0036e66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b06bb9b82c8f9a522dde213b1e0ddd535f22e3a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/babb146ceb79e71f328788f1e2c8c7c224026e61","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97449","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.230","lastModified":"2026-10-03T11:17:56.557","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Add package limit checks in parser functions\n\nAdd package limit checks in parser functions to prevent out-of-bounds\naccess."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/nsxfname.c","drivers/acpi/acpica/psargs.c","drivers/acpi/acpica/psloop.c","drivers/acpi/acpica/psparse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c82d4adeeb5acbd5231f082da11155017a4c241e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7beb63a99f43c090ec235e44773bd906b3fded9f","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"55594743fb6935d046cb6ce1e9f588828b43f3e9","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2442772fd79a440c067936f307c4948c570d6f81","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"250800658bf3db32e7accc615b0a134c30fba203","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"1cac04312b77fb81209da13bf5e0b83962568fcb","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d27d48a528e437aed690f977e69a6fe73fe82ab5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/nsxfname.c","drivers/acpi/acpica/psargs.c","drivers/acpi/acpica/psloop.c","drivers/acpi/acpica/psparse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1cac04312b77fb81209da13bf5e0b83962568fcb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2442772fd79a440c067936f307c4948c570d6f81","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/250800658bf3db32e7accc615b0a134c30fba203","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55594743fb6935d046cb6ce1e9f588828b43f3e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7beb63a99f43c090ec235e44773bd906b3fded9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c82d4adeeb5acbd5231f082da11155017a4c241e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d27d48a528e437aed690f977e69a6fe73fe82ab5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97450","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.350","lastModified":"2026-10-03T11:17:56.667","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: validate handler object type in two places\n\nACPICA: validate handler object type in acpi_ev_has_default_handler()\nand acpi_ev_find_region_handler()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/evhandler.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7af2da201623ab5bc0773bd3eeb2f2345cfa1c4a","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9d9fbf6b895a23238e4a7b1a3230f648f0d952a1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e98825650c2eb1605c707fd1391ceed65bb8e481","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"254e304f68dc079906ce2df4723548ffe35f682a","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"bfd981d35ed3156414fd35b4fe311d5d25cbfca6","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4c977d57a784682dc8c6cce2f9253ef44ec28ae8","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c5296da2d516707862f8a2dbb4b515f777e5294f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/evhandler.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/254e304f68dc079906ce2df4723548ffe35f682a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c977d57a784682dc8c6cce2f9253ef44ec28ae8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7af2da201623ab5bc0773bd3eeb2f2345cfa1c4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d9fbf6b895a23238e4a7b1a3230f648f0d952a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfd981d35ed3156414fd35b4fe311d5d25cbfca6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c5296da2d516707862f8a2dbb4b515f777e5294f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e98825650c2eb1605c707fd1391ceed65bb8e481","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97451","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.463","lastModified":"2026-10-03T11:17:56.810","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)\n\nAdd overflow check for Index + Length to prevent integer overflow\nwhen calculating the truncation length. This prevents negative\nsize parameter being passed to memcpy()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/exoparg3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6da963ed4c3de0963c23809af3194323328080d2","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e539003886b34c8109574820b9ba67f0dbe62a12","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9010ad440f970e684324d507510415a67bc125e4","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4532c9cf006bb6323957897455b6a5ab45957a19","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d0d89f2e16a874e0f8fb17045da293e8bedf8b21","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b96401812cbfbb4803faabeefa1f20b8562268b3","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"0e2021f49e64b3c8a9aa880d0c62a218bfe147ce","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/exoparg3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0e2021f49e64b3c8a9aa880d0c62a218bfe147ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4532c9cf006bb6323957897455b6a5ab45957a19","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6da963ed4c3de0963c23809af3194323328080d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9010ad440f970e684324d507510415a67bc125e4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b96401812cbfbb4803faabeefa1f20b8562268b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0d89f2e16a874e0f8fb17045da293e8bedf8b21","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e539003886b34c8109574820b9ba67f0dbe62a12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97452","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.573","lastModified":"2026-10-03T11:17:56.963","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Prevent adding invalid references\n\nPrevent adding references for local, argument, and debug objects\nin acpi_ut_copy_simple_object()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/utcopy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2350a6f89eca45f9219f37b331e4083f96299996","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"61cb905c33d0e0c6ff3c9c90fb269331bce8c2c0","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d239ccf5069f892cc36b9befafda030b3ca789e6","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c2cf936b07b0a298637e56e53ef043c7ff8eee31","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e16d1e5fcb17dfc369e20095f8cf5e841101279e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a6cd2fc2d5429a5b7d5a8b9ba0e6663e8ccbc9ba","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6e8c55e13a5e3a9f38921d62924f18ceba3330eb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/utcopy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2350a6f89eca45f9219f37b331e4083f96299996","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61cb905c33d0e0c6ff3c9c90fb269331bce8c2c0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e8c55e13a5e3a9f38921d62924f18ceba3330eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6cd2fc2d5429a5b7d5a8b9ba0e6663e8ccbc9ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2cf936b07b0a298637e56e53ef043c7ff8eee31","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d239ccf5069f892cc36b9befafda030b3ca789e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e16d1e5fcb17dfc369e20095f8cf5e841101279e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97453","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.710","lastModified":"2026-10-03T11:17:57.110","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: validate byte_count in acpi_ps_get_next_package_length()\n\nValidate package length reading in acpi_ps_get_next_package_length()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/psargs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6b9904fc65d82bea4922a33038d075488954bcc9","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"802f83e628b8fa6106428ef05d3fb03f99816fd6","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"37e60db04eed9d6c5801d63f99cfd3af99b9a2c8","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6e0d26e6ec90340533722214b7a923521f91caa2","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"780f380c66b80030379bec65bb1bd09ce6f6d9fc","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9bc0e8c3df689765ad5161eb3aed15de8544f5ce","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d49c6ee08365a8596f639da46eb7e71752b0cd42","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/psargs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/37e60db04eed9d6c5801d63f99cfd3af99b9a2c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b9904fc65d82bea4922a33038d075488954bcc9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e0d26e6ec90340533722214b7a923521f91caa2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/780f380c66b80030379bec65bb1bd09ce6f6d9fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/802f83e628b8fa6106428ef05d3fb03f99816fd6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9bc0e8c3df689765ad5161eb3aed15de8544f5ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d49c6ee08365a8596f639da46eb7e71752b0cd42","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97454","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.823","lastModified":"2026-10-03T11:17:57.227","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: add boundary checks in acpi_ps_get_next_field()\n\nAdd boundary checks in acpi_ps_get_next_field() to prevent out-of-bounds\naccess."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/psargs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"1d704a9ba665f8d1598fc6f37a76cbd6547cdcb1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6ecf2a4855a728c4c46e33919fea9480052d62a7","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6509f56df51235fe447b624e40c098082717625c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7d97ecf2a4c7a77a9daa3fe76790ddecddc9cd0c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"add715fc1ef5b0a71afe22b3f02aa28775d9ba62","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"bc5b2158c7626e3e8a78c5bb93ce0a734a26b84a","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e15aa60de0256d63df2331bf5a4bc4dd287504cd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/psargs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/1d704a9ba665f8d1598fc6f37a76cbd6547cdcb1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6509f56df51235fe447b624e40c098082717625c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ecf2a4855a728c4c46e33919fea9480052d62a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d97ecf2a4c7a77a9daa3fe76790ddecddc9cd0c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/add715fc1ef5b0a71afe22b3f02aa28775d9ba62","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc5b2158c7626e3e8a78c5bb93ce0a734a26b84a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e15aa60de0256d63df2331bf5a4bc4dd287504cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97455","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.957","lastModified":"2026-10-03T11:17:57.370","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix use-after-free in acpi_ds_terminate_control_method()\n\nFix use-after-free issue in acpi_ds_terminate_control_method() by\nclearing references to method locals and arguments."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/dsmethod.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"460aed7b408508a2c28ca4fdd8d90a82bb4005aa","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3855d8992f5a88b033925cc4f6aef7a485f326cb","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2793b1c38f0053fd9b119ce4607dd056eb05d382","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"63ca6f67816a229e07a08cac4bef1b3858abde66","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"fe7b3d3b7490c2c0119f2d84fa33996dcbc71042","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"ef5a8d939c1e5b36e75450bbb5b6348faff4dcf3","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"945e87267cfd90937b3c637f87324cbb56998b72","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/dsmethod.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2793b1c38f0053fd9b119ce4607dd056eb05d382","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3855d8992f5a88b033925cc4f6aef7a485f326cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/460aed7b408508a2c28ca4fdd8d90a82bb4005aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/63ca6f67816a229e07a08cac4bef1b3858abde66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/945e87267cfd90937b3c637f87324cbb56998b72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ef5a8d939c1e5b36e75450bbb5b6348faff4dcf3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe7b3d3b7490c2c0119f2d84fa33996dcbc71042","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97456","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:24.127","lastModified":"2026-10-03T11:17:57.507","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix condition check in acpi_ps_parse_loop()\n\nFix condition check for AML_ELSE_OP in acpi_ps_parse_loop() to prevent\nout-of-bounds access."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/psloop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5088814a6e931350e5bd29f5d59fa40c6dbbdf10","lessThan":"c838d32fbe02a6d426aebf95d2aef97de92ddc43","versionType":"git","status":"affected"},{"version":"5088814a6e931350e5bd29f5d59fa40c6dbbdf10","lessThan":"b79f5cb2131956a7d2c99870336d9fcc6db80c4b","versionType":"git","status":"affected"},{"version":"5088814a6e931350e5bd29f5d59fa40c6dbbdf10","lessThan":"de2bbc8dbe7048f20f0a783a81e712fd3664de5b","versionType":"git","status":"affected"},{"version":"5088814a6e931350e5bd29f5d59fa40c6dbbdf10","lessThan":"4c22c9842c53b824743bdf1d8d19e1cdb908f82e","versionType":"git","status":"affected"},{"version":"5088814a6e931350e5bd29f5d59fa40c6dbbdf10","lessThan":"a477c6ef5335d2d0613ff7c1779a8209f16627c5","versionType":"git","status":"affected"},{"version":"5088814a6e931350e5bd29f5d59fa40c6dbbdf10","lessThan":"5d16f40b019e59df81deb594ed4eafefc8e43cc0","versionType":"git","status":"affected"},{"version":"5088814a6e931350e5bd29f5d59fa40c6dbbdf10","lessThan":"8de27e2d83c0d07ae9443c6304575b0609394bfd","versionType":"git","status":"affected"},{"version":"2e78935d1e27d31955ad2dad4abe6c453cf669fd","versionType":"git","status":"affected"},{"version":"4.17.3","lessThan":"4.18","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/psloop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.18","status":"affected"},{"version":"0","lessThan":"4.18","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4c22c9842c53b824743bdf1d8d19e1cdb908f82e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d16f40b019e59df81deb594ed4eafefc8e43cc0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8de27e2d83c0d07ae9443c6304575b0609394bfd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a477c6ef5335d2d0613ff7c1779a8209f16627c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b79f5cb2131956a7d2c99870336d9fcc6db80c4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c838d32fbe02a6d426aebf95d2aef97de92ddc43","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de2bbc8dbe7048f20f0a783a81e712fd3664de5b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97472","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:24.273","lastModified":"2026-10-03T11:17:57.617","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: addrconf: fix temp address generation after prefix deprecation\n\nWhen a router temporarily deprecates an IPv6 prefix (either by sending a\nRouter Advertisement with Preferred Lifetime = 0 or by letting the\nlifetime expire) and later restores it, the kernel permanently loses its\nability to generate temporary privacy addresses (RFC 8981) for that\nprefix.\n\nThis happens because the address worker attempts to generate a\nreplacement temporary address when the current one nears expiration. As\nthe base prefix is deprecated already, the generation fails after\nmarking the temporary address as already having spawned a replacement\n(ifp->regen_count++).\n\nWhen the router eventually restores the prefix, the temporary address\nbecomes active again. However, once it naturally expires, the address\nworker sees this temporary address already tried to generate one and\nskips the regeneration.\n\nFix the issue by resetting the regen_count check of the latest temp\naddress generated for the prefix updated by the incoming RA."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/addrconf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"76f793e3a47139d340185cbc1a314740c09b13d3","lessThan":"b00f7c1da82a809156f785ed37536c2d2584927d","versionType":"git","status":"affected"},{"version":"76f793e3a47139d340185cbc1a314740c09b13d3","lessThan":"6da8ba900b85e6478e211427630c67595fb707a4","versionType":"git","status":"affected"},{"version":"76f793e3a47139d340185cbc1a314740c09b13d3","lessThan":"4f7d2a8dc364c4e55d0a1533451339008512933f","versionType":"git","status":"affected"},{"version":"76f793e3a47139d340185cbc1a314740c09b13d3","lessThan":"f601ec5c92b3260c742f27a5d2fd289e30ae798f","versionType":"git","status":"affected"},{"version":"76f793e3a47139d340185cbc1a314740c09b13d3","lessThan":"bff7b87dfa28a1502c18d0c6f1fadda5162fa854","versionType":"git","status":"affected"},{"version":"76f793e3a47139d340185cbc1a314740c09b13d3","lessThan":"4df5597c65446135362f72880995e8920f058fa0","versionType":"git","status":"affected"},{"version":"76f793e3a47139d340185cbc1a314740c09b13d3","lessThan":"e20d8922aa8fe441d291364c96c2179a005b79ea","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/addrconf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4df5597c65446135362f72880995e8920f058fa0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4f7d2a8dc364c4e55d0a1533451339008512933f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6da8ba900b85e6478e211427630c67595fb707a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b00f7c1da82a809156f785ed37536c2d2584927d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bff7b87dfa28a1502c18d0c6f1fadda5162fa854","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e20d8922aa8fe441d291364c96c2179a005b79ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f601ec5c92b3260c742f27a5d2fd289e30ae798f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97473","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:24.390","lastModified":"2026-09-28T06:16:33.170","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npowercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked()\n\nWhen topology_physical_package_id()/topology_logical_die_id() returns\na negative value, rapl_add_package_cpuslocked() returns ERR_PTR(-EINVAL)\ndirectly without freeing the rapl_package structure that was just\nallocated by kzalloc_obj(), leaking memory on every failed package\naddition.\n\nUse the existing err_free_package label so that the allocation is\nreleased on the error path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/powercap/intel_rapl_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"26096aed255fbac9501718174dbb24c935d8854e","lessThan":"3e9e9337e03be946ec93f2c9d28dab242482be1b","versionType":"git","status":"affected"},{"version":"26096aed255fbac9501718174dbb24c935d8854e","lessThan":"992c60771749d8d8cbfbd06049785fff95c72df1","versionType":"git","status":"affected"},{"version":"26096aed255fbac9501718174dbb24c935d8854e","lessThan":"bfc7d93bc5e12288e5dc6bb54260f68cdf5a5c47","versionType":"git","status":"affected"},{"version":"f8a7fa068be099fe3406178ab047cba7c8456203","versionType":"git","status":"affected"},{"version":"f575a20bd53ea755800e79c2b7aea20e9b0b2242","versionType":"git","status":"affected"},{"version":"6.10.12","lessThan":"6.11","versionType":"semver","status":"affected"},{"version":"6.11.1","lessThan":"6.12","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/powercap/intel_rapl_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3e9e9337e03be946ec93f2c9d28dab242482be1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/992c60771749d8d8cbfbd06049785fff95c72df1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfc7d93bc5e12288e5dc6bb54260f68cdf5a5c47","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97474","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:24.547","lastModified":"2026-09-28T06:16:33.277","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: purge async notifications upon nic error\n\nThis fixes a kernel panic in reconfig failure:\n\n1. we have a BSS connection\n2. we have a NAN connection\n3. FW error occurs\n4. reconfig restores the BSS connection\n5. however, restoring the NAN connection fails due to a FW error.\n6. erroneously, ieee80211_handle_reconfig_failure is called and marks all\n   interfaces as not-in-driver (will be fixed in a different patch).\n7. mac80211 frees the links of the BSS connection but doesn't tell the\n   driver about that, as it thinks that this vif is not in the driver.\n8. in ieee80211_stop_device, *ALL* wiphy works are getting flushed\n   (erroneously?)\n9. Therefore, async_handlers_wk is being executed, processing the\n   statistics notification that was received after we restored the BSS\n   connection.\n10. the notification handler dereferences fw_id_to_bss_conf[id], which is\n    now a dangling pointer, as mac80211 already freed this link in (7).\n11. On the first access to one of the links fields, we panic.\n\nWhile this can and should be fixed by removing the call to\nieee80211_handle_reconfig_failure in (6), it is also not a good idea to\ncarry and maybe handle notifications from a dead FW.\n\nWe do purge the notifications when we stop the FW, but in reconfig\nfailure we stop the FW too late, after the notifications are processed.\nIn addition, async_handlers_wk can always be scheduled before the\nreconfig work.\n\nPurge the notifications immediately when transport notifies about a nic\nerror."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mld/mld.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d1e879ec600f9b3bdd253167533959facfefb17b","lessThan":"1b3b7b521041d55459f8457db8921e9778482063","versionType":"git","status":"affected"},{"version":"d1e879ec600f9b3bdd253167533959facfefb17b","lessThan":"a40ad60a47f7c904b75a9ff83b39edebf3961c85","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mld/mld.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.4,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1b3b7b521041d55459f8457db8921e9778482063","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a40ad60a47f7c904b75a9ff83b39edebf3961c85","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97475","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:24.800","lastModified":"2026-10-03T11:17:57.737","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nthermal/drivers/tegra/soctherma: Switch to devm cooling device registration\n\nUse devm_thermal_of_cooling_device_register() to simplify resource\nmanagement and avoid manual cleanup in error paths.\n\nAs a side effect this change has the benefit of solving an existing\nissue. Before, the function tegra_soctherm_remove() only called\ndebugfs_remove_recursive() and never called thermal_cooling_device_unregister()\nfor any of the cooling devices registered here.\n\nAfter the driver removal, the thermal framework's cdev list would\nstill hold references to thermal_cooling_device objects whose devdata\npointer (ts) pointed to memory already freed by the platform device's\ndevm cleanup.\n\nWith this change, the cooling device is unregistered when the driver\nis removed, thus fixing the issue above."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/thermal/tegra/soctherm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ce0dbf04f685d48ffdec64a17ebb4965f828c3ff","lessThan":"78a2ba09fd7501df09239c7e3c311c80c259ed31","versionType":"git","status":"affected"},{"version":"ce0dbf04f685d48ffdec64a17ebb4965f828c3ff","lessThan":"0c65f786a69402620306828aa19817fd71f37f4b","versionType":"git","status":"affected"},{"version":"ce0dbf04f685d48ffdec64a17ebb4965f828c3ff","lessThan":"e777ab46db8c2addffe801274d713252318ef750","versionType":"git","status":"affected"},{"version":"ce0dbf04f685d48ffdec64a17ebb4965f828c3ff","lessThan":"a643ce49ddcdbdec173e7bbf4c32c897e0293ba9","versionType":"git","status":"affected"},{"version":"ce0dbf04f685d48ffdec64a17ebb4965f828c3ff","lessThan":"6f2a863e7e9adf6088fe644259576181e60ee5e5","versionType":"git","status":"affected"},{"version":"ce0dbf04f685d48ffdec64a17ebb4965f828c3ff","lessThan":"deaeb7be8e6b04c8b71080acba1bd88698f56b1d","versionType":"git","status":"affected"},{"version":"ce0dbf04f685d48ffdec64a17ebb4965f828c3ff","lessThan":"ee126267bc04bfb03816ae9d71ca24c5bf99e739","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/thermal/tegra/soctherm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0c65f786a69402620306828aa19817fd71f37f4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f2a863e7e9adf6088fe644259576181e60ee5e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78a2ba09fd7501df09239c7e3c311c80c259ed31","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a643ce49ddcdbdec173e7bbf4c32c897e0293ba9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/deaeb7be8e6b04c8b71080acba1bd88698f56b1d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e777ab46db8c2addffe801274d713252318ef750","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee126267bc04bfb03816ae9d71ca24c5bf99e739","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97476","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:24.933","lastModified":"2026-10-03T11:17:57.857","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrds: filter RDS_INFO_* getsockopt by caller's netns\n\nThe RDS_INFO_* family of getsockopt(2) options reads several\nfile-scope global lists that are not per-netns:\n\n  rds_sock_info / rds6_sock_info,\n  rds_sock_inc_info / rds6_sock_inc_info        -> rds_sock_list\n  rds_tcp_tc_info / rds6_tcp_tc_info            -> rds_tcp_tc_list\n  rds_conn_info / rds6_conn_info,\n  rds_conn_message_info_cmn (for the *_SEND_MESSAGES and\n  *_RETRANS_MESSAGES variants),\n  rds_for_each_conn_info (for RDS_INFO_IB_CONNECTIONS)\n                                                -> rds_conn_hash[]\n\nThe handlers do not filter by the caller's network namespace.\nrds_info_getsockopt() has no netns or capable() check, and\nrds_create() has no capable() check, so AF_RDS is reachable from\nan unprivileged user namespace. As a result, an unprivileged\ncaller in a fresh user_ns plus netns can read the bound address\nand sock inode of every RDS socket on the host, the peer address\nof incoming messages on every RDS socket on the host, the peer\naddress and TCP sequence numbers of every rds-tcp connection on\nthe host, and the peer address and RDS sequence numbers of every\nRDS connection on the host.\n\nThe rds-tcp transport is reachable from a non-initial netns (see\nrds_set_transport()), so a one-shot init_net gate at\nrds_info_getsockopt() would deny legitimate per-netns visibility\nto rds-tcp callers. Instead, filter at each handler by comparing\nthe netns of the caller's socket to the netns of the list entry,\nor to rds_conn_net(conn) for connection paths. Only copy entries\nwhose netns matches the caller. Counters (RDS_INFO_COUNTERS) are\naggregate statistics and remain global.\n\nReproducer (KASAN VM, rds and rds_tcp loaded): an AF_RDS socket\nbinds 127.0.0.1:4242 in init_net as root. A child process enters\na fresh user_ns plus netns and opens AF_RDS there, then calls\ngetsockopt(SOL_RDS, RDS_INFO_SOCKETS). Before this change, the\nchild sees the init_net socket. After this change, the child\nsees zero entries.\n\nDrop the rds_sock_count, rds_tcp_tc_count, and rds6_tcp_tc_count\nglobals. v2 used them for the size precheck and lens->nr; v3\nreplaced the precheck with a per-ns count from a first pass over\nthe list, so the globals have no remaining readers. The matching\nincrements and decrements in rds_create()/rds_destroy_sock() and\nrds_tcp_set_callbacks()/rds_tcp_restore_callbacks() go away with\nthem. Reported by the kernel test robot under clang W=1."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/rds/af_rds.c","net/rds/connection.c","net/rds/tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4","lessThan":"64ca5839916176c3451f61a2c7178033423c67d7","versionType":"git","status":"affected"},{"version":"639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4","lessThan":"8b04dda272c30d46834bb03dd2895b08c090483b","versionType":"git","status":"affected"},{"version":"639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4","lessThan":"f05142d0eeaa6e8227511c88e10a2b8fe7a78fc4","versionType":"git","status":"affected"},{"version":"639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4","lessThan":"65fae4b42269dbea7e3842ae4dd0786162c6248e","versionType":"git","status":"affected"},{"version":"639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4","lessThan":"093f172296d32499ffac7809629b206178776eb6","versionType":"git","status":"affected"},{"version":"639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4","lessThan":"c4081e49ebe0e3160c4b70ec7639494792dee206","versionType":"git","status":"affected"},{"version":"639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4","lessThan":"c96a5209dda666004b8ee1ed7f0d493d09a4f200","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/rds/af_rds.c","net/rds/connection.c","net/rds/tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","lessThan":"2.6.30","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/093f172296d32499ffac7809629b206178776eb6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64ca5839916176c3451f61a2c7178033423c67d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65fae4b42269dbea7e3842ae4dd0786162c6248e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b04dda272c30d46834bb03dd2895b08c090483b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4081e49ebe0e3160c4b70ec7639494792dee206","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c96a5209dda666004b8ee1ed7f0d493d09a4f200","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f05142d0eeaa6e8227511c88e10a2b8fe7a78fc4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97477","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.063","lastModified":"2026-10-21T13:21:10.067","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()\n\nWhen __rdma_counter_bind_qp() fails in alloc_and_bind(), the error path\njumps to err_mode which frees the counter without decrementing\nport_counter->num_counters. The only place that decrements is\nrdma_counter_free(), which is unreachable since the counter was never\nsuccessfully bound.\n\nThis leak accumulates across repeated failures, permanently preventing\nthe port from switching to AUTO mode (-EBUSY in __counter_set_mode())\nand blocking the MANUAL→NONE auto-revert in rdma_counter_free(). When\nthe mode was NONE before the call, the MANUAL mode set by\n__counter_set_mode() also leaks since the revert logic is never\nreached.\n\nAdd an err_bind label between the num_counters increment and the\nexisting err_mode label. It decrements num_counters and mirrors the\nMANUAL→NONE revert from rdma_counter_free(), ensuring the port state\nis fully restored on bind failure."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/core/counters.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8bc205eff3056a9ed3850937cdd2192f05e6d3cb","lessThan":"7c9fee40fc8d8d928f44e99bc6e6adf93f9f2c2a","versionType":"git","status":"affected"},{"version":"8bc205eff3056a9ed3850937cdd2192f05e6d3cb","lessThan":"1bcdeddddffadff9993657f6b0e5535d66ebd10f","versionType":"git","status":"affected"},{"version":"8bc205eff3056a9ed3850937cdd2192f05e6d3cb","lessThan":"da95cb016812c0e012ea839f191926e35ca8f57f","versionType":"git","status":"affected"},{"version":"8bc205eff3056a9ed3850937cdd2192f05e6d3cb","lessThan":"4fbc8230009f5b1bcd13cc74c5a6a43ddba141fd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/core/counters.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1bcdeddddffadff9993657f6b0e5535d66ebd10f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4fbc8230009f5b1bcd13cc74c5a6a43ddba141fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c9fee40fc8d8d928f44e99bc6e6adf93f9f2c2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da95cb016812c0e012ea839f191926e35ca8f57f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97478","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.183","lastModified":"2026-10-21T13:21:10.193","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: acrn: Fix irqfd use-after-free during eventfd shutdown\n\nacrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free\nthe same struct hsm_irqfd:\n\n  CPU0                                 CPU1\n  ----                                 ----\n  eventfd_release()\n    wake_up_poll(EPOLLHUP)\n      hsm_irqfd_wakeup()\n        queue_work(&irqfd->shutdown)\n                                       acrn_irqfd_deassign()\n                                         hsm_irqfd_shutdown()\n                                           list_del_init()\n                                           eventfd_ctx_remove_wait_queue()\n                                           eventfd_ctx_put()\n                                         kfree(irqfd)\n  hsm_irqfd_shutdown_work()\n    container_of(work, ..., shutdown)\n    irqfd->vm                  <-- use-after-free\n\nThe deassign path freed the irqfd while a shutdown work item was\nalready queued by EPOLLHUP (or vice versa), so the work item could\nresurrect a dangling pointer through container_of().\n\nSwitch to the lifetime model used by KVM irqfds:\n\n - Deassign/deinit only deactivate the irqfd: remove it from vm->irqfds\n   under irqfds_lock and queue the cleanup work.\n - hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the\n   eventfd waitqueue entry, drops the eventfd reference and frees the\n   irqfd.\n - A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit()\n   ensures the cleanup work is queued at most once, no matter how many\n   of {EPOLLHUP, deassign, deinit} fire concurrently.  This is safe to\n   call from the waitqueue callback, which runs with wqh->lock held and\n   IRQs disabled and therefore cannot take irqfds_lock.\n - acrn_irqfd_deassign() flushes vm->irqfd_wq before returning so the\n   eventfd is fully detached on return.  acrn_irqfd_deinit() deactivates\n   every irqfd, flushes the workqueue and only then destroys it, so no\n   path can queue_work() onto a torn-down workqueue.\n - acrn_irqfd_assign() now installs the eventfd waitqueue entry and\n   publishes the irqfd to vm->irqfds under irqfds_lock, so the irqfd is\n   never visible to deassign/deinit before its waitqueue entry is in\n   place, and any EPOLLHUP that fires in the assign window queues\n   cleanup work that blocks on irqfds_lock until publication is done."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/virt/acrn/irqfd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"aa3b483ff1d71c50b33db154048dff9a8f08ac71","lessThan":"6e9e007ee1dfb54bc2d070550308077ec28dbaec","versionType":"git","status":"affected"},{"version":"aa3b483ff1d71c50b33db154048dff9a8f08ac71","lessThan":"0e1152f689847b9db2f05454775d34610c1424c2","versionType":"git","status":"affected"},{"version":"aa3b483ff1d71c50b33db154048dff9a8f08ac71","lessThan":"d8156aacfcabb81f52c20ef89094945434d08079","versionType":"git","status":"affected"},{"version":"aa3b483ff1d71c50b33db154048dff9a8f08ac71","lessThan":"666c7f9e07925aa0863348f960e09bb89f8f05a3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/virt/acrn/irqfd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0e1152f689847b9db2f05454775d34610c1424c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/666c7f9e07925aa0863348f960e09bb89f8f05a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e9e007ee1dfb54bc2d070550308077ec28dbaec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d8156aacfcabb81f52c20ef89094945434d08079","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97479","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.337","lastModified":"2026-10-21T13:21:10.423","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: Avoid warning when removing a device while its supplier is unbinding\n\nDuring driver removal, the following warning can appear:\n   WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 __device_links_no_driver+0xcc/0xfc\n   ...\n   Call trace:\n     __device_links_no_driver+0xcc/0xfc (P)\n     device_links_driver_cleanup+0xa8/0xf0\n     device_release_driver_internal+0x208/0x23c\n     device_links_unbind_consumers+0xe0/0x108\n     device_release_driver_internal+0xec/0x23c\n     device_links_unbind_consumers+0xe0/0x108\n     device_release_driver_internal+0xec/0x23c\n     device_links_unbind_consumers+0xe0/0x108\n     device_release_driver_internal+0xec/0x23c\n     driver_detach+0xa0/0x12c\n     bus_remove_driver+0x6c/0xbc\n     driver_unregister+0x30/0x60\n     pci_unregister_driver+0x20/0x9c\n     lan966x_pci_driver_exit+0x18/0xa90 [lan966x_pci]\n\nThis warning is triggered when a consumer is removed because the links\nstatus of its supplier is not DL_DEV_DRIVER_BOUND and the link flag\nDL_FLAG_SYNC_STATE_ONLY is not set.\n\nThe topology in terms of consumers/suppliers used was the following\n(consumer ---> supplier):\n\n      i2c -----------> OIC ----> PCI device\n       |                ^\n       |                |\n       +---> pinctrl ---+\n\nWhen the PCI device is removed, the OIC (interrupt controller) has to be\nremoved. In order to remove the OIC, pinctrl and i2c need to be removed\nand to remove pinctrl, i2c need to be removed. The removal order is:\n  1) i2c\n  2) pinctrl\n  3) OIC\n  4) PCI device\n\nIn details, the removal sequence is the following (with 0000:01:00.0 the\nPCI device):\n  driver_detach: call device_release_driver_internal(0000:01:00.0)...\n    device_links_busy(0000:01:00.0):\n      links->status = DL_DEV_UNBINDING\n    device_links_unbind_consumers(0000:01:00.0):\n      0000:01:00.0--oic link->status = DL_STATE_SUPPLIER_UNBIND\n      call device_release_driver_internal(oic)...\n        device_links_busy(oic):\n          links->status = DL_DEV_UNBINDING\n        device_links_unbind_consumers(oic):\n          oic--pinctrl link->status = DL_STATE_SUPPLIER_UNBIND\n          call device_release_driver_internal(pinctrl)...\n            device_links_busy(pinctrl):\n              links->status = DL_DEV_UNBINDING\n            device_links_unbind_consumers(pinctrl):\n              pinctrl--i2c link->status = DL_STATE_SUPPLIER_UNBIND\n              call device_release_driver_internal(i2c)...\n                device_links_busy(i2c): links->status = DL_DEV_UNBINDING\n                __device_links_no_driver(i2c)...\n                  pinctrl--i2c link->status is DL_STATE_SUPPLIER_UNBIND\n                  oic--i2c link->status is DL_STATE_ACTIVE\n                  oic--i2c link->supplier->links.status is DL_DEV_UNBINDING\n\nThe warning is triggered by the i2c removal because the OIC (supplier)\nlinks status is not DL_DEV_DRIVER_BOUND. Its links status is indeed set\nto DL_DEV_UNBINDING.\n\nIt is perfectly legit to have the links status set to DL_DEV_UNBINDING\nin that case. Indeed we had started to unbind the OIC which triggered\nthe consumer unbinding and didn't finish yet when the i2c is unbound.\n\nAvoid the warning when the supplier links status is set to\nDL_DEV_UNBINDING and thus support this removal sequence without any\nwarnings."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/base/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8c3e315d4296421cd26b3300ee0ac117f0877f20","lessThan":"d5eb39d6178ca88db706c7b82dcd19a77f30aa9e","versionType":"git","status":"affected"},{"version":"8c3e315d4296421cd26b3300ee0ac117f0877f20","lessThan":"da22e4bce2a8cbed32dcda407b7d06cb5feec8e3","versionType":"git","status":"affected"},{"version":"8c3e315d4296421cd26b3300ee0ac117f0877f20","lessThan":"73ea4ec0ec46d12558a61842b474e7dd63538edc","versionType":"git","status":"affected"},{"version":"8c3e315d4296421cd26b3300ee0ac117f0877f20","lessThan":"36d74f17e03f7e60e1b08fbe16cfad6e69cc3aa9","versionType":"git","status":"affected"},{"version":"2e5c082d3727522a3f30a50582784d24754d14a8","versionType":"git","status":"affected"},{"version":"70154bb515a325c007bcf64971099e1e17f16f28","versionType":"git","status":"affected"},{"version":"5.6.19","lessThan":"5.7","versionType":"semver","status":"affected"},{"version":"5.7.3","lessThan":"5.8","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/base/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/36d74f17e03f7e60e1b08fbe16cfad6e69cc3aa9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/73ea4ec0ec46d12558a61842b474e7dd63538edc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5eb39d6178ca88db706c7b82dcd19a77f30aa9e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da22e4bce2a8cbed32dcda407b7d06cb5feec8e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97480","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.467","lastModified":"2026-10-21T13:21:10.583","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: 8250: protect against NULL uart->port.dev in register\n\nserial8250_register_8250_port() conditionally copies uart->port.dev\nfrom up->port.dev only when up->port.dev is non-NULL:\n\n\tif (up->port.dev) {\n\t\tuart->port.dev = up->port.dev;\n\t\t...\n\t}\n\nSo if both the existing uart slot and up have a NULL ->dev,\nuart->port.dev remains NULL. The very next ACPI companion check\nthen dereferences it unconditionally:\n\n\tif (!has_acpi_companion(uart->port.dev)) {\n\nhas_acpi_companion() reads dev->fwnode without a NULL guard\n(include/linux/acpi.h), so this NULL-derefs the kernel for the\nremaining no-dev case rather than just skipping the\nmctrl_gpio_init() initialisation as intended.\n\nsmatch flags the inconsistency:\n\n  drivers/tty/serial/8250/8250_core.c:767\n  serial8250_register_8250_port() error: 'uart->port.dev' could be\n  null (see line 719)\n\nGuard the call with a NULL check so register continues to work\nfor callers that legitimately have no parent device (legacy\nnon-OF/non-ACPI registrations).\n\nNo functional change for callers that pass a non-NULL ->dev."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/tty/serial/8250/8250_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4a96895f74c9633b51427fd080ab70fa62b65bc4","lessThan":"68059b6e9f7292714286e2b0f5185ed2a43fccc5","versionType":"git","status":"affected"},{"version":"4a96895f74c9633b51427fd080ab70fa62b65bc4","lessThan":"9c78f89cf2fbae18b14c78bf172ca15d832aff15","versionType":"git","status":"affected"},{"version":"4a96895f74c9633b51427fd080ab70fa62b65bc4","lessThan":"5cbab666721d974bfe033a12045d808936deaefd","versionType":"git","status":"affected"},{"version":"4a96895f74c9633b51427fd080ab70fa62b65bc4","lessThan":"941c9f84c9b6310f7aaa1c8c785dcc634ee33050","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/tty/serial/8250/8250_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5cbab666721d974bfe033a12045d808936deaefd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68059b6e9f7292714286e2b0f5185ed2a43fccc5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/941c9f84c9b6310f7aaa1c8c785dcc634ee33050","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c78f89cf2fbae18b14c78bf172ca15d832aff15","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97481","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.583","lastModified":"2026-10-03T11:17:57.987","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250: fix possible ISR soft lockup\n\nThere are rare cases in which the host gets stuck in the ISR because it\nis flooded with messages during the startup phase.\n\nThe reason for the soft lockup in the ISR is the missing FIFO error IRQ\n(FIFOE) handling. Not handling it and reporting IRQ_HANDLED triggers\nthe IRQ immediately again.\n\nFix this by adding a check for the FIFOE status and clearing the FIFO\nif no data is ready (DR).\n\nThis behavior was observed on an AM62L device which uses the OMAP 8250\ndriver. Fix it for all 8250 drivers, since the OMAP driver's special\nIRQ setup handling may trigger this behavior more frequently, but it\nis not ensured that other 8250 drivers aren't affected."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/tty/serial/8250/8250_port.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4bce4a6f6318035d77d6b6199527b1950bb015f4","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8b67af8cd90542b2607623e3282811849e191b79","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"95d0b40c0623fd2b58c753f8dd6adda7263e3cd1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"03ed804a0ddc3d069faf94c47f9e702afe5ca084","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2881b2e6da02daea1eb8254247ba8fd20c9d3348","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4295c58990b7a84e8349a2226db692e252825b60","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"0c6bf45e5a345cc3b9ffbeaf9083ecac3c2293eb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/tty/serial/8250/8250_port.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/03ed804a0ddc3d069faf94c47f9e702afe5ca084","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0c6bf45e5a345cc3b9ffbeaf9083ecac3c2293eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2881b2e6da02daea1eb8254247ba8fd20c9d3348","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4295c58990b7a84e8349a2226db692e252825b60","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4bce4a6f6318035d77d6b6199527b1950bb015f4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b67af8cd90542b2607623e3282811849e191b79","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/95d0b40c0623fd2b58c753f8dd6adda7263e3cd1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97482","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.707","lastModified":"2026-10-03T11:17:58.110","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log\n\ngoku_irq() handles a number of bus events under a single ep0 path.\nIt already guards the gadget driver suspend/resume callbacks against a\nNULL ->driver:\n\n\tif (dev->gadget.speed != USB_SPEED_UNKNOWN\n\t\t\t&& dev->driver\n\t\t\t&& dev->driver->resume) {\n\t\tspin_unlock(&dev->lock);\n\t\tdev->driver->resume(&dev->gadget);\n\t\t...\n\t}\n\nbut the very next branch unconditionally dereferences dev->driver\nwhen an INT_USBRESET arrives:\n\n\tif (stat & INT_USBRESET) {\n\t\tACK(INT_USBRESET);\n\t\tINFO(dev, \"USB reset done, gadget %s\\n\",\n\t\t\tdev->driver->driver.name);\n\t}\n\nIf the controller raises INT_USBRESET before any gadget driver has\nbeen bound (or after one has been unbound), dev->driver is NULL and\nthe printk dereferences NULL.\n\nsmatch flags the inconsistency:\n\n  drivers/usb/gadget/udc/goku_udc.c:1618 goku_irq() error:\n  we previously assumed 'dev->driver' could be null (see line 1607)\n\nFall back to a placeholder when the gadget driver is not bound.\n\nNo functional change while a gadget driver is bound."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/gadget/udc/goku_udc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d7b33afbf9b54b61cb423af9663df54eae11d3b1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"ea2901a4a90afc662e4d023542d91f10ab10fd3c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"999ff3bf665f2abfb6af519ef3d6d42b061d3c15","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a018d4195114ca2cf79858cc45c98581dee4795b","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"10d7fc3008d5b7ec03af8e08927f1d090014c2af","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"28d78783a871cdb7a637dcb72452ff7d303430ae","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5bf5e3fba9bc7dfd69701521dbe9809f8ccbdb02","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/gadget/udc/goku_udc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/10d7fc3008d5b7ec03af8e08927f1d090014c2af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/28d78783a871cdb7a637dcb72452ff7d303430ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5bf5e3fba9bc7dfd69701521dbe9809f8ccbdb02","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/999ff3bf665f2abfb6af519ef3d6d42b061d3c15","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a018d4195114ca2cf79858cc45c98581dee4795b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7b33afbf9b54b61cb423af9663df54eae11d3b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea2901a4a90afc662e4d023542d91f10ab10fd3c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97483","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.820","lastModified":"2026-10-03T11:17:58.227","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: hcd: fix possible deadlock in rh control transfers\n\n>From within the SCSI error handler memory allocations must not\ntrigger IO. Handling errors in UAS and the storage driver may\ninvolve resetting a device. The thread doing the reset itself\nrelies on VM magic. However, that is insufficient, as resetting\na device involves resuming it. Resumption as well as resetting\ninvolves conrol transfers to the parent of the device to be reset.\nThat may be a root hub. Hence usbcore must heed the flags passed\nto usb_submit_urb() processing control transfers to root hubs.\n\nThe problem exist since the storage driver has been merged."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/core/hcd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e57e780b346a7277fdd3bde765d9d8728b99bfa1","lessThan":"8461eda5af77c44d216cec66455bd5b01ee35c9a","versionType":"git","status":"affected"},{"version":"e57e780b346a7277fdd3bde765d9d8728b99bfa1","lessThan":"8f82fc3d72e5feb7a1efae94b51b431c5bf41c86","versionType":"git","status":"affected"},{"version":"e57e780b346a7277fdd3bde765d9d8728b99bfa1","lessThan":"936b08d87c667031725bcc753007e7c1182548c6","versionType":"git","status":"affected"},{"version":"e57e780b346a7277fdd3bde765d9d8728b99bfa1","lessThan":"d0291fb4d91982d9f6a680bf759ff0555d351ecb","versionType":"git","status":"affected"},{"version":"e57e780b346a7277fdd3bde765d9d8728b99bfa1","lessThan":"fff917c85d37a294397c5440a795591ca9d6b602","versionType":"git","status":"affected"},{"version":"e57e780b346a7277fdd3bde765d9d8728b99bfa1","lessThan":"549672a3fb6b36ea408238f89ecf9f41d2da6225","versionType":"git","status":"affected"},{"version":"e57e780b346a7277fdd3bde765d9d8728b99bfa1","lessThan":"d5559f43d76b398392b26a15cbc16d731969cd1c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/core/hcd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.12","status":"affected"},{"version":"0","lessThan":"3.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/549672a3fb6b36ea408238f89ecf9f41d2da6225","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8461eda5af77c44d216cec66455bd5b01ee35c9a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f82fc3d72e5feb7a1efae94b51b431c5bf41c86","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/936b08d87c667031725bcc753007e7c1182548c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0291fb4d91982d9f6a680bf759ff0555d351ecb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5559f43d76b398392b26a15cbc16d731969cd1c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fff917c85d37a294397c5440a795591ca9d6b602","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97484","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.933","lastModified":"2026-10-03T11:17:58.343","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: vhci_hcd: fix NULL deref in status_show_vhci\n\nplatform_get_drvdata() can return NULL if a VHCI host controller's\nprobe failed (e.g. due to USB bus number exhaustion). status_show_vhci()\nchecked for a NULL pdev but not for a NULL hcd returned by\nplatform_get_drvdata(). Passing NULL to hcd_to_vhci_hcd() does not\nreturn NULL - it returns a pointer offset of 0x260, causing a NULL\npointer dereference when that value is subsequently dereferenced.\n\nAdd a NULL check on hcd before calling hcd_to_vhci_hcd(). Move\nstatus_show_not_ready() above status_show_vhci() to make it callable\nfrom the new error path without a forward declaration."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/usbip/vhci_sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0775a9cbc694e8c7276688be3bbd2f386167ab54","lessThan":"2b477ee5cc9c2670185ffd82911a20e1760008c2","versionType":"git","status":"affected"},{"version":"0775a9cbc694e8c7276688be3bbd2f386167ab54","lessThan":"671d2687a790f63110c3c4213230209f5c3e0e8e","versionType":"git","status":"affected"},{"version":"0775a9cbc694e8c7276688be3bbd2f386167ab54","lessThan":"fd7d938ab4759a45eb107e658c199a2c47cc1ace","versionType":"git","status":"affected"},{"version":"0775a9cbc694e8c7276688be3bbd2f386167ab54","lessThan":"517c353e5358b2123cbf620a1798fe632fb7bdce","versionType":"git","status":"affected"},{"version":"0775a9cbc694e8c7276688be3bbd2f386167ab54","lessThan":"046a94fdb02eb1df86c8fa4614104ff801ba3ab7","versionType":"git","status":"affected"},{"version":"0775a9cbc694e8c7276688be3bbd2f386167ab54","lessThan":"dacd7c317ba12e035653c28a0eaaf23d91abc073","versionType":"git","status":"affected"},{"version":"0775a9cbc694e8c7276688be3bbd2f386167ab54","lessThan":"bc150783542ba2e7c1257d1299c6f3269bdba270","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/usbip/vhci_sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/046a94fdb02eb1df86c8fa4614104ff801ba3ab7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2b477ee5cc9c2670185ffd82911a20e1760008c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/517c353e5358b2123cbf620a1798fe632fb7bdce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/671d2687a790f63110c3c4213230209f5c3e0e8e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc150783542ba2e7c1257d1299c6f3269bdba270","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dacd7c317ba12e035653c28a0eaaf23d91abc073","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd7d938ab4759a45eb107e658c199a2c47cc1ace","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97485","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.050","lastModified":"2026-10-03T11:17:58.457","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nomfs: handle set_blocksize failures\n\nomfs uses buffer_heads, which don't handle block size > PAGE_SIZE well.\nWithout this, mounting we will hit the\n\n        BUG_ON(offset >= folio_size(folio));\n\nin folio_set_bh on the first __bread_gfp call."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/omfs/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"555e3775ced1d05203934fc6529bbf0560dd8733","lessThan":"a2a3592ebf3920dd6f2b754d2bb7361f54764e84","versionType":"git","status":"affected"},{"version":"555e3775ced1d05203934fc6529bbf0560dd8733","lessThan":"d81e1e9bd1df5948c699cb5aec984acdef5b2681","versionType":"git","status":"affected"},{"version":"555e3775ced1d05203934fc6529bbf0560dd8733","lessThan":"120e0db84a69f18e51ba9ae2d036df3a052a33e1","versionType":"git","status":"affected"},{"version":"555e3775ced1d05203934fc6529bbf0560dd8733","lessThan":"29186cd17bb5f501a6ae831dac4fabf637879982","versionType":"git","status":"affected"},{"version":"555e3775ced1d05203934fc6529bbf0560dd8733","lessThan":"61ffc31cd8642d7a950b6831720629c8331365f6","versionType":"git","status":"affected"},{"version":"555e3775ced1d05203934fc6529bbf0560dd8733","lessThan":"fd4d6593c51253c79be422d6ae42e318250e20a7","versionType":"git","status":"affected"},{"version":"555e3775ced1d05203934fc6529bbf0560dd8733","lessThan":"18c3d6fcb557f920c9143711497625e70153874c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/omfs/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.27","status":"affected"},{"version":"0","lessThan":"2.6.27","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/120e0db84a69f18e51ba9ae2d036df3a052a33e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/18c3d6fcb557f920c9143711497625e70153874c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29186cd17bb5f501a6ae831dac4fabf637879982","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61ffc31cd8642d7a950b6831720629c8331365f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a2a3592ebf3920dd6f2b754d2bb7361f54764e84","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d81e1e9bd1df5948c699cb5aec984acdef5b2681","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd4d6593c51253c79be422d6ae42e318250e20a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97486","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.160","lastModified":"2026-10-03T11:17:58.577","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhpfs: handle set_blocksize failures\n\nhpfs uses buffer_heads, which don't handle block size > PAGE_SIZE well.\nWithout this, mounting will hit the\n\n        BUG_ON(offset >= folio_size(folio));\n\nin folio_set_bh on the first __bread_gfp call."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/hpfs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f7b0cde62edb8ceff8bcc17ba3f1b086646fff89","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b618f681acb6748faf95eee9af2aac5455a74e68","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"10f226687bcb07ed925a453b6f25e817165d113b","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"0451927f42b0282d80d402e8e8c46ff34e9f606f","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"fc79fcc78cb771f2a803e52149cac5ca9050fd05","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f27e21cf3c0446a3536ea9b588a78a46b0a2cb66","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a405996f23e04942aad064ab8d50c55827482872","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/hpfs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0451927f42b0282d80d402e8e8c46ff34e9f606f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/10f226687bcb07ed925a453b6f25e817165d113b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a405996f23e04942aad064ab8d50c55827482872","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b618f681acb6748faf95eee9af2aac5455a74e68","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f27e21cf3c0446a3536ea9b588a78a46b0a2cb66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f7b0cde62edb8ceff8bcc17ba3f1b086646fff89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc79fcc78cb771f2a803e52149cac5ca9050fd05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97487","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.263","lastModified":"2026-10-03T11:17:58.697","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\njfs: handle set_blocksize failures\n\njfs uses buffer_heads, which don't handle block size > PAGE_SIZE well.\nWithout this, mounting we will hit the\n\n        BUG_ON(offset >= folio_size(folio));\n\nin folio_set_bh on the first __bread_gfp call."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/jfs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e2712fa5c02cd1b3e40d45bc8ce581f3c67bf4b4","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"deb9400a38849e03210c9169b777e89e74debe96","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a0eaa3f4b6dcc829228752f6255f0e45cc94b273","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"87d6852f06c5a29f757f7b7ad1423e4cbd0f2cad","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a0ac22af8acca6ea6c57aff72662086cb3243b1c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"153374ee67a458c77b5755d3cc57fbdc639d327e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"05107f5602751fcfd3d108c1f579eb45aabead52","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/jfs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/05107f5602751fcfd3d108c1f579eb45aabead52","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/153374ee67a458c77b5755d3cc57fbdc639d327e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87d6852f06c5a29f757f7b7ad1423e4cbd0f2cad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0ac22af8acca6ea6c57aff72662086cb3243b1c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0eaa3f4b6dcc829228752f6255f0e45cc94b273","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/deb9400a38849e03210c9169b777e89e74debe96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2712fa5c02cd1b3e40d45bc8ce581f3c67bf4b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97488","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.370","lastModified":"2026-10-03T11:17:58.803","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nqnx4: handle set_blocksize failures\n\nqnx4 uses buffer_heads, which don't handle block size > PAGE_SIZE well.\nWithout this, mounting will hit the\n\n        BUG_ON(offset >= folio_size(folio));\n\nin folio_set_bh on the first __bread_gfp call."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/qnx4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"de8bd760ca0c2a3f337bbafbeb1dcad0853787cc","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3f2088a3973faf3ed9b56ea3d3f0240b9a797016","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c9f03e750d9ddf0f42c24e3ba683f26e377ffd72","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f83e416c2242fb298ad33b756c83aae75d9e359c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"aac97a4b3f47c36a47f934aa679407b718b67537","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"60f7ccf669882262330171eda51a4f52fa2e69c9","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c7d911ea1cc9a63b07e52f5e75b263be0615b289","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/qnx4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3f2088a3973faf3ed9b56ea3d3f0240b9a797016","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/60f7ccf669882262330171eda51a4f52fa2e69c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aac97a4b3f47c36a47f934aa679407b718b67537","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c7d911ea1cc9a63b07e52f5e75b263be0615b289","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9f03e750d9ddf0f42c24e3ba683f26e377ffd72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de8bd760ca0c2a3f337bbafbeb1dcad0853787cc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f83e416c2242fb298ad33b756c83aae75d9e359c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97489","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.490","lastModified":"2026-10-03T11:17:58.920","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbfs: handle set_blocksize failures\n\nbfs uses buffer_heads, which don't handle block size > PAGE_SIZE well.\nWithout this, mounting will hit the\n\n\tBUG_ON(offset >= folio_size(folio));\n\nin folio_set_bh on the first __bread_gfp call."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/bfs/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"965b53ee91cfda3faf8bd0d0ffff5f70c7d1c479","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"0fe260d82555ffebfb627cd23cbb6e880399804c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c6d069c34d57414c039167967ef826a8516c98f3","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8a96010d230a8c83181137d88bad4bf71d862628","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7cc713b29eecc0189a184e82f42d174fddaa9e1e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"ab1d6160d26e6ee8939e994999be9b45e90a42ef","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2430e3380936df0b648af720cae624eef035a2d1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/bfs/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0fe260d82555ffebfb627cd23cbb6e880399804c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2430e3380936df0b648af720cae624eef035a2d1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cc713b29eecc0189a184e82f42d174fddaa9e1e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8a96010d230a8c83181137d88bad4bf71d862628","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/965b53ee91cfda3faf8bd0d0ffff5f70c7d1c479","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab1d6160d26e6ee8939e994999be9b45e90a42ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c6d069c34d57414c039167967ef826a8516c98f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97490","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.603","lastModified":"2026-10-03T11:17:59.030","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naffs: handle set_blocksize failures\n\naffs uses buffer_heads, which don't handle block size > PAGE_SIZE well.\nWithout this, mounting we will hit the\n\n        BUG_ON(offset >= folio_size(folio));\n\nin folio_set_bh on the first __bread_gfp call."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/affs/affs.h","fs/affs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f5d65b2811872e8f8b424860fa7c2500afbbc5a6","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c7f29c5d999093629712c63792abda89a36b428d","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d05b0ee9b42cb3cc499272d1bc91609f7492a1a8","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"ea8a4a9f3cc101207611be724a8b83838de9a93f","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"bb45146a661934ef801f8fc62f88cdbcf6584ed1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e01af5aa641039e000af855f448475316f0550fc","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"0861182af5983a39bd2a891966436c5679b74a45","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/affs/affs.h","fs/affs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0861182af5983a39bd2a891966436c5679b74a45","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb45146a661934ef801f8fc62f88cdbcf6584ed1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c7f29c5d999093629712c63792abda89a36b428d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d05b0ee9b42cb3cc499272d1bc91609f7492a1a8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e01af5aa641039e000af855f448475316f0550fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea8a4a9f3cc101207611be724a8b83838de9a93f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5d65b2811872e8f8b424860fa7c2500afbbc5a6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97491","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.720","lastModified":"2026-10-03T11:17:59.147","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: Don't sleep inside rds_ib_conn_path_shutdown\n\nNew rds rdma self tests exposed a hang when tearing down\nthe ib network configs.  This is caused by the shutdown worker\nthread sleeping on the wait_event call, which blocks other work\nitems in the queue. Fix this by changing wait_event to\nwait_event timeout, and looping until the wait check succeeds."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/rds/ib_cm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ec16227e14141e4fd7ae76354c09dadfe2449d9e","lessThan":"b3621acf640e32dcb986d9b3767f2387f29dad05","versionType":"git","status":"affected"},{"version":"ec16227e14141e4fd7ae76354c09dadfe2449d9e","lessThan":"ac0bc28da5150c4fa81a76172fff5ec70f2063eb","versionType":"git","status":"affected"},{"version":"ec16227e14141e4fd7ae76354c09dadfe2449d9e","lessThan":"934a6381c79d815680c955d676791322e020bfda","versionType":"git","status":"affected"},{"version":"ec16227e14141e4fd7ae76354c09dadfe2449d9e","lessThan":"07a348d48e589b91a0d5a5cfa0de137cc703fabf","versionType":"git","status":"affected"},{"version":"ec16227e14141e4fd7ae76354c09dadfe2449d9e","lessThan":"db22e77df66353f1299153f6fa9620a2825bc63f","versionType":"git","status":"affected"},{"version":"ec16227e14141e4fd7ae76354c09dadfe2449d9e","lessThan":"caa51e6da596ed6008cd06605a725568b8e7be4e","versionType":"git","status":"affected"},{"version":"ec16227e14141e4fd7ae76354c09dadfe2449d9e","lessThan":"16f48efaeb6991193fb7775c577f06f5b20b0c90","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/rds/ib_cm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","lessThan":"2.6.30","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/07a348d48e589b91a0d5a5cfa0de137cc703fabf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/16f48efaeb6991193fb7775c577f06f5b20b0c90","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/934a6381c79d815680c955d676791322e020bfda","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac0bc28da5150c4fa81a76172fff5ec70f2063eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b3621acf640e32dcb986d9b3767f2387f29dad05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/caa51e6da596ed6008cd06605a725568b8e7be4e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db22e77df66353f1299153f6fa9620a2825bc63f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97492","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.833","lastModified":"2026-10-21T13:21:10.713","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed\n\nIn case reconfiguration of NAN fails, we call\nieee80211_handle_reconfig_failure, that marks all interfaces as not in\nthe driver.\nThen, at the error path of the reconfig, cfg80211_shutdown_all_interfaces\nis called to destroy all the interfaces.\n\nIf we have any other interface but the NAN one, for example a BSS\nstation, then when its state (links, stations) will be removed, we\nwon't tell the driver about this, because we will think that the\ninterfaces are not in the driver, and then drivers might remain with\ndangling pointers to objects like stations and links (at least for\niwlwifi this is the case).\n\nieee80211_handle_reconfig_failure is meant to be called after we cleaned\nup the state in the driver, there is no reason to call it for NAN\nreconfiguration failure.\n\nFix the code to just warn in such a case, as we do in other error paths\nin reconfig where it is too complicated to rewind."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"167e33f4f68cc8e4e3bdaf6d43641176c51f2d79","lessThan":"026637b864b16dfae238e7e1accded820a3d7ae8","versionType":"git","status":"affected"},{"version":"167e33f4f68cc8e4e3bdaf6d43641176c51f2d79","lessThan":"6ef85dd9f8c62c9a465a32901d09475a114e67bd","versionType":"git","status":"affected"},{"version":"167e33f4f68cc8e4e3bdaf6d43641176c51f2d79","lessThan":"f27a5bda84ff3b0fea3de7572ff48e518e66cf5d","versionType":"git","status":"affected"},{"version":"167e33f4f68cc8e4e3bdaf6d43641176c51f2d79","lessThan":"d2ea99884793c0a8d940073c3dddbb887590718f","versionType":"git","status":"affected"},{"version":"167e33f4f68cc8e4e3bdaf6d43641176c51f2d79","lessThan":"60b96e44489d6775fe9cd8df619c29e0dc285c49","versionType":"git","status":"affected"},{"version":"167e33f4f68cc8e4e3bdaf6d43641176c51f2d79","lessThan":"6fb64029457cdcd77be546daf4c7c7cf04891857","versionType":"git","status":"affected"},{"version":"167e33f4f68cc8e4e3bdaf6d43641176c51f2d79","lessThan":"7a8a3ff2815501f78f494808355ddf37e08647d0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/026637b864b16dfae238e7e1accded820a3d7ae8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/60b96e44489d6775fe9cd8df619c29e0dc285c49","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ef85dd9f8c62c9a465a32901d09475a114e67bd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fb64029457cdcd77be546daf4c7c7cf04891857","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a8a3ff2815501f78f494808355ddf37e08647d0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d2ea99884793c0a8d940073c3dddbb887590718f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f27a5bda84ff3b0fea3de7572ff48e518e66cf5d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97493","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.947","lastModified":"2026-10-21T13:21:10.883","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Bound GPIO I2C table entry count from VBIOS\n\nReject undersized tables and cap the derived entry count\nto AMDGPU_MAX_I2C_BUS so we do not overrun adev->i2c_bus[]\nor walk an absurd number of entries on corrupt size fields."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","lessThan":"0786b38af822fcd153d565cc85be7dbd9fed4d25","versionType":"git","status":"affected"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","lessThan":"6db45123306c7167c6867ca3d24924bd7960d947","versionType":"git","status":"affected"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","lessThan":"f8f0985375c3b977757fd73e2b691ff1bf1ea7b9","versionType":"git","status":"affected"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","lessThan":"a99cd231cd924b7160fecb9fb3a94b801522323b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0786b38af822fcd153d565cc85be7dbd9fed4d25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6db45123306c7167c6867ca3d24924bd7960d947","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a99cd231cd924b7160fecb9fb3a94b801522323b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8f0985375c3b977757fd73e2b691ff1bf1ea7b9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97494","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.060","lastModified":"2026-10-21T13:21:10.997","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw\n\nChange psp_copy_fw from void to int: return -ENODEV when drm_dev_enter\nfails, and -EINVAL when the image size is zero or larger than the\n1 MiB PSP private buffer.\n\nReplace open-coded memset/memcpy into fw_pri_buf with psp_copy_fw."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c","drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h","drivers/gpu/drm/amd/amdgpu/psp_v11_0.c","drivers/gpu/drm/amd/amdgpu/psp_v12_0.c","drivers/gpu/drm/amd/amdgpu/psp_v13_0.c","drivers/gpu/drm/amd/amdgpu/psp_v13_0_4.c","drivers/gpu/drm/amd/amdgpu/psp_v14_0.c","drivers/gpu/drm/amd/amdgpu/psp_v3_1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2b0c3aee2172451e9f982b25f3fdf59a1b687dc3","lessThan":"8ddda06ae356fda0418b7017e658d976dad6214e","versionType":"git","status":"affected"},{"version":"2b0c3aee2172451e9f982b25f3fdf59a1b687dc3","lessThan":"25bec2425c3d50ba9a92ad87bbf8628be29e5c32","versionType":"git","status":"affected"},{"version":"2b0c3aee2172451e9f982b25f3fdf59a1b687dc3","lessThan":"1aa55af304a2decaacca1d1fabe4257c277ca54a","versionType":"git","status":"affected"},{"version":"2b0c3aee2172451e9f982b25f3fdf59a1b687dc3","lessThan":"d1f9f5839bd785a3a06335a01d53282e80f8e5fa","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c","drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h","drivers/gpu/drm/amd/amdgpu/psp_v11_0.c","drivers/gpu/drm/amd/amdgpu/psp_v12_0.c","drivers/gpu/drm/amd/amdgpu/psp_v13_0.c","drivers/gpu/drm/amd/amdgpu/psp_v13_0_4.c","drivers/gpu/drm/amd/amdgpu/psp_v14_0.c","drivers/gpu/drm/amd/amdgpu/psp_v3_1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1aa55af304a2decaacca1d1fabe4257c277ca54a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/25bec2425c3d50ba9a92ad87bbf8628be29e5c32","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8ddda06ae356fda0418b7017e658d976dad6214e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1f9f5839bd785a3a06335a01d53282e80f8e5fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97495","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.173","lastModified":"2026-10-03T11:17:59.373","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Check bounds on allocate_doorbell\n\nallocated_doorbell has an option to set the doorbell id\nto a specific value (used by CRIU). This value was not\nbounds checked.\n\nCheck to confirm it's less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5bb6a8fa75fcfda93592bee0a4910420ceab15f3","lessThan":"7e06636260a2d95e3fa181bc337d0eeb812b7a41","versionType":"git","status":"affected"},{"version":"5bb6a8fa75fcfda93592bee0a4910420ceab15f3","lessThan":"3d2ddfc9b361b0d38c3ff4804ce42503e4bc97de","versionType":"git","status":"affected"},{"version":"5bb6a8fa75fcfda93592bee0a4910420ceab15f3","lessThan":"e0cecd04a4fc4c75e375b91cf53eab5ba2e4ab7f","versionType":"git","status":"affected"},{"version":"5bb6a8fa75fcfda93592bee0a4910420ceab15f3","lessThan":"c2c89118c27cbd3adace62c5df19d15b0e96ade1","versionType":"git","status":"affected"},{"version":"5bb6a8fa75fcfda93592bee0a4910420ceab15f3","lessThan":"1f087bb8cf9e8797633da35c85435e557ef74d06","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1f087bb8cf9e8797633da35c85435e557ef74d06","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3d2ddfc9b361b0d38c3ff4804ce42503e4bc97de","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e06636260a2d95e3fa181bc337d0eeb812b7a41","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2c89118c27cbd3adace62c5df19d15b0e96ade1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e0cecd04a4fc4c75e375b91cf53eab5ba2e4ab7f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97496","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.290","lastModified":"2026-10-03T11:17:59.480","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix OOB memory exposure in get_wave_state()\n\nThe get_wave_state() function for v9 trusts cp_hqd_cntl_stack_size and\ncp_hqd_cntl_stack_offset values read directly from the MQD, which are\nwritten by GPU microcode and fully attacker-controlled on the\nCRIU-restore path (via AMDKFD_IOC_RESTORE_PROCESS with H3).\n\nthis leads to an unbounded copy_to_user() that can leak adjacent\nGTT/kernel memory. If offset > size, integer underflow produces a ~4 GiB\nread length, if size is set to 1 MiB against a 4 KiB allocation, we leak\n1 MiB of adjacent kernel memory (other queues' MQDs, ring buffers, KASLR\npointers).\n\nFix by clamping both cp_hqd_cntl_stack_size to the actual allocated\nbuffer size (q->ctl_stack_size) and cp_hqd_cntl_stack_offset to the\nclamped size before performing arithmetic and copy_to_user().\n\nThis ensures we never read beyond the allocated kernel BO regardless of\nattacker-supplied MQD field values."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"42c6c48214b726c30918e8dc80e2168607d13ae4","lessThan":"e2bef0f168be46692a6b900916ff5da3771480ed","versionType":"git","status":"affected"},{"version":"42c6c48214b726c30918e8dc80e2168607d13ae4","lessThan":"d9183d974ddd5f09d029beaf359275ac20d4d5fe","versionType":"git","status":"affected"},{"version":"42c6c48214b726c30918e8dc80e2168607d13ae4","lessThan":"ec646686613d8ab05b282d1463a7baa49fd6b83b","versionType":"git","status":"affected"},{"version":"42c6c48214b726c30918e8dc80e2168607d13ae4","lessThan":"7ef144458f48d5589e36f1b3d83e83db2e5c5ba5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/7ef144458f48d5589e36f1b3d83e83db2e5c5ba5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9183d974ddd5f09d029beaf359275ac20d4d5fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2bef0f168be46692a6b900916ff5da3771480ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ec646686613d8ab05b282d1463a7baa49fd6b83b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97497","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.410","lastModified":"2026-10-03T11:17:59.613","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id\n\nallocate_sdma_queue has an option where the sdma queue id can be\nspecified (used by CRIU). We weren't bounds-checking that\nvalue.\n\nConfirm it's less than the maximum number of queues."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2485c12c980a36bb9e23ababb07d73c4ac6a45af","lessThan":"41460d2dd0246f0ab7e80b103d34c8649e022999","versionType":"git","status":"affected"},{"version":"2485c12c980a36bb9e23ababb07d73c4ac6a45af","lessThan":"25e1b29ecc8da3609ba0072ca54a3b1fdd1578f3","versionType":"git","status":"affected"},{"version":"2485c12c980a36bb9e23ababb07d73c4ac6a45af","lessThan":"42f2bd50236b61ad0aeb2c233c990ee0d615fdad","versionType":"git","status":"affected"},{"version":"2485c12c980a36bb9e23ababb07d73c4ac6a45af","lessThan":"dd2870ca036e1d51baa59f942007b36a595b5890","versionType":"git","status":"affected"},{"version":"2485c12c980a36bb9e23ababb07d73c4ac6a45af","lessThan":"bfe9a7545b2a7be1c543f1741e16f2d5ec4116ae","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/25e1b29ecc8da3609ba0072ca54a3b1fdd1578f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41460d2dd0246f0ab7e80b103d34c8649e022999","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42f2bd50236b61ad0aeb2c233c990ee0d615fdad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfe9a7545b2a7be1c543f1741e16f2d5ec4116ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd2870ca036e1d51baa59f942007b36a595b5890","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97498","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.527","lastModified":"2026-09-28T06:16:35.800","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/userq: pin mqd and fw object bo to avoid eviction\n\nmqd and fw objects are queue core objects which should remain\nvalid and never be unmapped and evicted for user queues to work\nproperly.\n\nDuring eviction if these buffers are evicted the hw continue to\nuse the invalid addresses and caused page faults and system hung."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0385800c2ff7bddf16a9caad5840f4e4823253f2","lessThan":"a16d9986b7b27b08a696524a4dbf03dbf5433a16","versionType":"git","status":"affected"},{"version":"0385800c2ff7bddf16a9caad5840f4e4823253f2","lessThan":"a3bbf32a336939a1d21b9561f8e53333b684b7ef","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/a16d9986b7b27b08a696524a4dbf03dbf5433a16","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3bbf32a336939a1d21b9561f8e53333b684b7ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97499","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.630","lastModified":"2026-09-28T06:16:35.893","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: perf: Retrieve path and source from event data\n\nETM perf callbacks currently use the per-CPU csdev_src pointer, which\ncan race with updates during device registration and unregistration.\n\nThe AUX setup already builds and stores the path in the event data.\nUse this path to retrieve the source instead of csdev_src to avoid\nthe race.\n\nExport coresight_get_source() and add etm_event_get_ctxt_path() to\nretrieve the context's path and its source with READ_ONCE() /\nWRITE_ONCE() accessors. Give the comments to explain why this\napproach is safe when pause or resume callbacks preempt the disable\ncallback (e.g. via NMI)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwtracing/coresight/coresight-core.c","drivers/hwtracing/coresight/coresight-etm-perf.c","drivers/hwtracing/coresight/coresight-priv.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0bcbf2e30ff2271b54f54c8697a185f7d86ec6e4","lessThan":"0f4cb08f30011b7625a4fba668fa5c36da5e6637","versionType":"git","status":"affected"},{"version":"0bcbf2e30ff2271b54f54c8697a185f7d86ec6e4","lessThan":"f37bc31447c0ddafedb25e3c4a4f4e2284034247","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwtracing/coresight/coresight-core.c","drivers/hwtracing/coresight/coresight-etm-perf.c","drivers/hwtracing/coresight/coresight-priv.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.6","status":"affected"},{"version":"0","lessThan":"4.6","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0f4cb08f30011b7625a4fba668fa5c36da5e6637","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f37bc31447c0ddafedb25e3c4a4f4e2284034247","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97500","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.740","lastModified":"2026-10-03T11:17:59.740","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: phy: check length before parsing PHY status IE\n\nHardware might report PHY status IE with unexpected length, and parser\nmight access out of range. Check the length ahead."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/realtek/rtw89/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd","lessThan":"72bf6944e336d6f046f5c886ebededdd6560a693","versionType":"git","status":"affected"},{"version":"e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd","lessThan":"213f9e0ab2b4f35fe8d342333238c6cc91513fbf","versionType":"git","status":"affected"},{"version":"e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd","lessThan":"98e5720afd7495eece580238f232e3b3b4c022da","versionType":"git","status":"affected"},{"version":"e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd","lessThan":"884495c39de1a02f42bd40051b921e2311d6ac91","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/realtek/rtw89/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/213f9e0ab2b4f35fe8d342333238c6cc91513fbf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72bf6944e336d6f046f5c886ebededdd6560a693","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/884495c39de1a02f42bd40051b921e2311d6ac91","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98e5720afd7495eece580238f232e3b3b4c022da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97501","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.850","lastModified":"2026-10-21T13:21:11.113","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction\n\npinctrl_gpio_direction_input() / pinctrl_gpio_direction_output() take\nthe pinctrl mutex. This causes a gpiochip operations to need to sleep.\nWorse yet, the .can_sleep field in the gpiochip is not set. This causes\nthe shared GPIO proxy to trip over, as it uses gpiod_cansleep() to check\nwhether it can use a spinlock or needs a mutex. In this case, it ends\nup taking a spinlock, then calls pinctrl_gpio_direction_output(), which\ntakes a mutex. This causes a huge warning.\n\nWhile this class of Mediatek hardware does not have separate clear/set\nregisters, the pinctrl context has a spinlock that is taken whenever\na register read-modify-write is done. Also, once the GPIO function is\nselected / muxed in, further GPIO operations do not involve pinctrl\noperations or state. The GPIO direction and level values do not require\ntoggling the pinmux or any other pin config options.\n\nSwitch to directly calling mtk_pinmux_gpio_set_direction() in the GPIO\nset direction callbacks to avoid taking the pinctrl mutex. Drop the\n.gpio_set_direction field in mtk_pmxops to signal we are no longer using\nthe pinctrl GPIO layer for setting the direction."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pinctrl/mediatek/pinctrl-paris.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"805250982bb5c5ce4a6e52e1d87204c5feea0dd1","lessThan":"482ba972f9638f467df2d498b46384a1d1f80529","versionType":"git","status":"affected"},{"version":"805250982bb5c5ce4a6e52e1d87204c5feea0dd1","lessThan":"3c4897861759fd8bd81dc2ada92121ac76332592","versionType":"git","status":"affected"},{"version":"805250982bb5c5ce4a6e52e1d87204c5feea0dd1","lessThan":"428b031dad390edd5da729b9afd474a95dc4f76b","versionType":"git","status":"affected"},{"version":"805250982bb5c5ce4a6e52e1d87204c5feea0dd1","lessThan":"c87c9046c4e00d599454e033a477176c4d73ac2a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pinctrl/mediatek/pinctrl-paris.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3c4897861759fd8bd81dc2ada92121ac76332592","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/428b031dad390edd5da729b9afd474a95dc4f76b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/482ba972f9638f467df2d498b46384a1d1f80529","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c87c9046c4e00d599454e033a477176c4d73ac2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97502","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.963","lastModified":"2026-10-03T11:17:59.840","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: davinci: avoid NULL deref of host->data in IRQ handler\n\nmmc_davinci_irq() returns early only when both host->cmd and\nhost->data are NULL:\n\n  if (host->cmd == NULL && host->data == NULL) {\n          ...\n          return IRQ_NONE;\n  }\n\nSo we may legitimately reach the rest of the handler with\nhost->data == NULL (and therefore data == NULL). The DATDNE branch\nalready guards against this with an explicit \"if (data != NULL)\"\ncheck, but the subsequent TOUTRD (\"read data timeout\") and\nCRCWR/CRCRD (\"data CRC error\") branches dereference data\nunconditionally:\n\n  if (qstatus & MMCST0_TOUTRD) {\n          data->error = -ETIMEDOUT;        <-- NULL deref\n          ...\n          davinci_abort_data(host, data);\n  }\n\n  if (qstatus & (MMCST0_CRCWR | MMCST0_CRCRD)) {\n          data->error = -EILSEQ;           <-- NULL deref\n          ...\n  }\n\nIf either bit is set in qstatus while host->data is NULL, the kernel\nwill crash inside the IRQ handler. smatch flags this:\n\n  drivers/mmc/host/davinci_mmc.c:933 mmc_davinci_irq() error: we\n    previously assumed 'data' could be null (see line 914)\n\nGate both branches on a non-NULL data, matching the existing pattern\nused by the DATDNE branch.\n\nNo functional change for callers where data is non-NULL, which is\nthe only case in which these branches did meaningful work before\nthis change."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/mmc/host/davinci_mmc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b4cff4549b7a8c5fc8b88e3493b6287555f0512c","lessThan":"51738de7dd5f8e8b33dfc07ef85bc06d3bf41e96","versionType":"git","status":"affected"},{"version":"b4cff4549b7a8c5fc8b88e3493b6287555f0512c","lessThan":"f216cf00e829895ff49bdf695c944915e59bd698","versionType":"git","status":"affected"},{"version":"b4cff4549b7a8c5fc8b88e3493b6287555f0512c","lessThan":"a0cde8d70d64c1a75fbd57f01d9f2d7cccac8319","versionType":"git","status":"affected"},{"version":"b4cff4549b7a8c5fc8b88e3493b6287555f0512c","lessThan":"3c5e3e5badbf0592332887d12db02458323682c3","versionType":"git","status":"affected"},{"version":"b4cff4549b7a8c5fc8b88e3493b6287555f0512c","lessThan":"a01cedf230dc0fcd55b994f5e548d3982ba4c732","versionType":"git","status":"affected"},{"version":"b4cff4549b7a8c5fc8b88e3493b6287555f0512c","lessThan":"5b7e151fe9ea9311ba601849aaecdc4fc97fd577","versionType":"git","status":"affected"},{"version":"b4cff4549b7a8c5fc8b88e3493b6287555f0512c","lessThan":"4f28846aaf8db9668e338b8987973f8935edff34","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/mmc/host/davinci_mmc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.33","status":"affected"},{"version":"0","lessThan":"2.6.33","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3c5e3e5badbf0592332887d12db02458323682c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4f28846aaf8db9668e338b8987973f8935edff34","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/51738de7dd5f8e8b33dfc07ef85bc06d3bf41e96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5b7e151fe9ea9311ba601849aaecdc4fc97fd577","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a01cedf230dc0fcd55b994f5e548d3982ba4c732","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0cde8d70d64c1a75fbd57f01d9f2d7cccac8319","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f216cf00e829895ff49bdf695c944915e59bd698","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97503","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.080","lastModified":"2026-10-21T13:21:11.260","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngenirq/proc: Size interrupt directory names for 10-digit interrupt numbers\n\n/proc/irq/<n>/ directory names are built in `char name[10]` buffers\nwith `sprintf(name, \"%u\", irq)`.\n\nTen-digit IRQ numbers already need 11 bytes including the trailing NUL, and\ncurrent sparse-IRQ configurations allow interrupt numbers in that range.\n\nSize the temporary name buffer for the current decimal form and switch\nto bounded formatting when creating or removing the proc entry."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/irq/proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"721255b9826bd11c7a38b585905fc2dd0fb94e52","lessThan":"a8adf64fe7fd5d7c476769a043ee56eda7b775ce","versionType":"git","status":"affected"},{"version":"721255b9826bd11c7a38b585905fc2dd0fb94e52","lessThan":"488bcd7fd3e9a2ad647b71b505a269fdb28753c4","versionType":"git","status":"affected"},{"version":"721255b9826bd11c7a38b585905fc2dd0fb94e52","lessThan":"d4b22fbae70037299e96539c330e4a1054b28a91","versionType":"git","status":"affected"},{"version":"721255b9826bd11c7a38b585905fc2dd0fb94e52","lessThan":"c2c7983c93f5d86962318be7e7298f1bc3feb1a6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/irq/proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/488bcd7fd3e9a2ad647b71b505a269fdb28753c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8adf64fe7fd5d7c476769a043ee56eda7b775ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2c7983c93f5d86962318be7e7298f1bc3feb1a6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d4b22fbae70037299e96539c330e4a1054b28a91","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97504","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.200","lastModified":"2026-09-28T06:16:36.373","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk\n\nReview by sashiko.dev highlighted potential use after free and resource\nleak instances.\n\nSet se10_pdev to null to prevent use after free\n\nRemove DMI call back and instead directly call\nse10_create_platform_device. Handle error cases appropriately"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/watchdog/lenovo_se10_wdt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1f6602c8ed1eccac4fa83e338d02aafe3a0e2c0a","lessThan":"e9adbc3a116dfa8c7b643180dabf6166c99bcec7","versionType":"git","status":"affected"},{"version":"1f6602c8ed1eccac4fa83e338d02aafe3a0e2c0a","lessThan":"c9f1fb55646534370b00824a1fdb47718c72f115","versionType":"git","status":"affected"},{"version":"1f6602c8ed1eccac4fa83e338d02aafe3a0e2c0a","lessThan":"3394e894880a60338a2981dd688fd25e88d79667","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/watchdog/lenovo_se10_wdt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3394e894880a60338a2981dd688fd25e88d79667","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9f1fb55646534370b00824a1fdb47718c72f115","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9adbc3a116dfa8c7b643180dabf6166c99bcec7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97505","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.310","lastModified":"2026-10-21T13:21:11.390","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()\n\nCurrently, the __resource_resize_store() allows writing to the\nresourceN_resize sysfs attribute to change a BAR's size without checking\nfor capabilities, currently relying only on the file access check.\n\nResizing a BAR modifies PCI device configuration and can disrupt active\ndrivers.  After the upcoming conversion to static attributes, it will also\ntrigger resource file updates via sysfs_update_groups().\n\nAdd a CAP_SYS_ADMIN check to prevent unprivileged users from performing BAR\nresize operations."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/pci-sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"91fa127794ac1c48069479b9d45eb4c7378c0e30","lessThan":"d02dd7ce8e52b66b7d3b6eca2a7d81e7f5b10a62","versionType":"git","status":"affected"},{"version":"91fa127794ac1c48069479b9d45eb4c7378c0e30","lessThan":"b722a607f858b9cd036075ea0efad553fb98e982","versionType":"git","status":"affected"},{"version":"91fa127794ac1c48069479b9d45eb4c7378c0e30","lessThan":"cbf0628c0b7db86c5ce36451f088101546acbf1d","versionType":"git","status":"affected"},{"version":"91fa127794ac1c48069479b9d45eb4c7378c0e30","lessThan":"25ec7f57deceec633f27bc93b615f951e2ade814","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/pci-sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/25ec7f57deceec633f27bc93b615f951e2ade814","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b722a607f858b9cd036075ea0efad553fb98e982","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cbf0628c0b7db86c5ce36451f088101546acbf1d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d02dd7ce8e52b66b7d3b6eca2a7d81e7f5b10a62","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97506","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.423","lastModified":"2026-10-03T11:17:59.963","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ixp4xx - fix buffer chain unwind on allocation failure\n\nchainup_buffers() builds a linked list of buffer descriptors for a\nscatterlist. If dma_pool_alloc() fails while constructing the list, the\ncurrent code sets buf to NULL and later dereferences it unconditionally\nat the end of the function:\n\n  buf->next = NULL;\n  buf->phys_next = 0;\n\nThis can lead to a null-pointer dereference on allocation failure.\n\nIf the failure happens after part of the descriptor chain has already\nbeen allocated and DMA-mapped, the partially constructed chain also\nneeds to be released.\n\nFix this by terminating the partially constructed chain on allocation\nfailure and letting the callers unwind it via their existing cleanup\npaths. Also fix ablk_perform() to preserve the hook pointers before\nchecking for failure, so partially built chains can be freed correctly."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0d44dc59b2b434b29aafeae581d06f81efac7c83","lessThan":"d4007867be42d71795b78fa7f8ce7514dda9ca83","versionType":"git","status":"affected"},{"version":"0d44dc59b2b434b29aafeae581d06f81efac7c83","lessThan":"4918b0bd7d2baafb45d87dca9e322137c96005c2","versionType":"git","status":"affected"},{"version":"0d44dc59b2b434b29aafeae581d06f81efac7c83","lessThan":"8c37bc8d6a6f77bf9593fb1bcab6c14c7cf02991","versionType":"git","status":"affected"},{"version":"0d44dc59b2b434b29aafeae581d06f81efac7c83","lessThan":"04cb00106ca4d0fa9eca24cadc4eda6036e855c8","versionType":"git","status":"affected"},{"version":"0d44dc59b2b434b29aafeae581d06f81efac7c83","lessThan":"028a7f4f3d69e551f6bf9f728d547bbf4cfc707d","versionType":"git","status":"affected"},{"version":"0d44dc59b2b434b29aafeae581d06f81efac7c83","lessThan":"25056329384010a8672552b134f609601dc4f80e","versionType":"git","status":"affected"},{"version":"5a80273150a8a1725fa70418d106eb1f2ee8fd2f","versionType":"git","status":"affected"},{"version":"82a8becb9c2c52fc5e67057a43aeded1f0731e7b","versionType":"git","status":"affected"},{"version":"68845515c8b11791b547a2838e22c27dfa3115ee","versionType":"git","status":"affected"},{"version":"2.6.27.22","lessThan":"2.6.28","versionType":"semver","status":"affected"},{"version":"2.6.28.10","lessThan":"2.6.29","versionType":"semver","status":"affected"},{"version":"2.6.29.3","lessThan":"2.6.30","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","lessThan":"2.6.30","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/028a7f4f3d69e551f6bf9f728d547bbf4cfc707d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/04cb00106ca4d0fa9eca24cadc4eda6036e855c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/25056329384010a8672552b134f609601dc4f80e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4918b0bd7d2baafb45d87dca9e322137c96005c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c37bc8d6a6f77bf9593fb1bcab6c14c7cf02991","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d4007867be42d71795b78fa7f8ce7514dda9ca83","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97507","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.540","lastModified":"2026-10-03T11:18:00.093","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dm1105: fix missing error check for dma_alloc_coherent\n\nThe return value of dm1105_dma_map(), which handles DMA memory allocation,\nis ignored in dm1105_hw_init(). If dma_alloc_coherent() fails, the driver\nwill proceed using a NULL pointer for DMA transfers, leading to a kernel\noops or invalid hardware access.\n\nFix this by checking the return value and propagating -ENOMEM on failure."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/media/pci/dm1105/dm1105.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a611d0ca006fe76d88b8dd5ac44f4468293b6760","lessThan":"a2017c80dd7f3c409778ca0898d6e75ccab6d2f2","versionType":"git","status":"affected"},{"version":"a611d0ca006fe76d88b8dd5ac44f4468293b6760","lessThan":"e96f91da5c83e4c1f1bebe1c58856d02cea4afd9","versionType":"git","status":"affected"},{"version":"a611d0ca006fe76d88b8dd5ac44f4468293b6760","lessThan":"3ff12d5ea9cb0d0fd89c24b69940f0b989bf6d2a","versionType":"git","status":"affected"},{"version":"a611d0ca006fe76d88b8dd5ac44f4468293b6760","lessThan":"b6327023dcc7482156fc13cda6361ee573721b05","versionType":"git","status":"affected"},{"version":"a611d0ca006fe76d88b8dd5ac44f4468293b6760","lessThan":"07d6a76a17b550e94ca5cc0060ad6e77952390f2","versionType":"git","status":"affected"},{"version":"a611d0ca006fe76d88b8dd5ac44f4468293b6760","lessThan":"f3f135c4fac6194933b952e98a15dc05aa420956","versionType":"git","status":"affected"},{"version":"a611d0ca006fe76d88b8dd5ac44f4468293b6760","lessThan":"3eaac9e02d8591d3c790db572ef1c8fa5a841fdb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/media/pci/dm1105/dm1105.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.28","status":"affected"},{"version":"0","lessThan":"2.6.28","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/07d6a76a17b550e94ca5cc0060ad6e77952390f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3eaac9e02d8591d3c790db572ef1c8fa5a841fdb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3ff12d5ea9cb0d0fd89c24b69940f0b989bf6d2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a2017c80dd7f3c409778ca0898d6e75ccab6d2f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6327023dcc7482156fc13cda6361ee573721b05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e96f91da5c83e4c1f1bebe1c58856d02cea4afd9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f3f135c4fac6194933b952e98a15dc05aa420956","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97508","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.650","lastModified":"2026-10-03T11:18:00.283","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Set tb->root_switch to NULL when domain is stopped\n\nSimilarly what we do with the firmware connection manager. This makes\ntb_xdp_handle_request() return error to the remote host. However, we\nneed to make sure we keep the uuid alive so that we can reply until the\nwhole domain is released."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/thunderbolt/tb.c","drivers/thunderbolt/xdomain.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"d9a638e7bc87e0e6fe3a75517ac481e72fc0058c","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"66b0fe27e277713c2b9f3c452c76330ed0bd7eaf","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"54ad3415cc211ca0d64ae1bf3234d6eb5c6aedd0","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"83d1af5b1b6e6c96ffa633ca2c9a77f6f4c93efa","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"f06e9fbae78a51832211b4495a19412c7d49ecb4","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"99f019d2e9eb79adc485fef8aa8ada2cd0c843e9","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"e56249d8a68e712f3b60e1f3fdbb5b4fea146468","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/thunderbolt/tb.c","drivers/thunderbolt/xdomain.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.15","status":"affected"},{"version":"0","lessThan":"4.15","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/54ad3415cc211ca0d64ae1bf3234d6eb5c6aedd0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/66b0fe27e277713c2b9f3c452c76330ed0bd7eaf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83d1af5b1b6e6c96ffa633ca2c9a77f6f4c93efa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/99f019d2e9eb79adc485fef8aa8ada2cd0c843e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9a638e7bc87e0e6fe3a75517ac481e72fc0058c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e56249d8a68e712f3b60e1f3fdbb5b4fea146468","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f06e9fbae78a51832211b4495a19412c7d49ecb4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97509","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.767","lastModified":"2026-10-03T11:18:00.487","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Keep XDomain reference during the lifetime of a service\n\nThis is needed because we release the service ID in tb_service_release()\nand the ID array is owned by the parent XDomain."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/thunderbolt/xdomain.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"a4567e5380e4e46d0ea9a28d2d675e5c6f013d54","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"daeaa6c7211d03ed061b0dd22a875fad9372b090","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"cca72fe513f3d6b1279fe83483f8a8990adbe0c6","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"57359bb31526c2f1bb0a7b9b69d8b8a6bd3f0e9f","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"8ab12d015884b8aa85ea7ed58c5a0bae4264fe60","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"ea60ae6233ca0fc0d414e9c11f0d86c63b303fc7","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"8b4060998637f06975fceee9b73845d8672d411e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/thunderbolt/xdomain.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.15","status":"affected"},{"version":"0","lessThan":"4.15","versionType":"semver","status":"unaffected"},{"version":"5.10.266","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.217","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/57359bb31526c2f1bb0a7b9b69d8b8a6bd3f0e9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8ab12d015884b8aa85ea7ed58c5a0bae4264fe60","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b4060998637f06975fceee9b73845d8672d411e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4567e5380e4e46d0ea9a28d2d675e5c6f013d54","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cca72fe513f3d6b1279fe83483f8a8990adbe0c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/daeaa6c7211d03ed061b0dd22a875fad9372b090","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea60ae6233ca0fc0d414e9c11f0d86c63b303fc7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97510","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.887","lastModified":"2026-10-03T11:18:00.627","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()\n\nIf tb_cfg_request() fails setting up the request (for example the\ncontrol channel is shut down already) it returns an error without\ncalling the callback. To avoid leaking that memory, call\ntb_cfg_request_put() if tb_cfg_request() fails."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/thunderbolt/xdomain.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"dbc8a8dd7c1930043c473818fcadcf88cb5e1c4d","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"487ee7dbad21d1e757f5dd490ac182aebfa5f689","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"000189b249e45e63ee873d0c59c3be1805349681","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"9d6657674919bef57c8a7195170263f3456e9876","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"42dddadf6b6131af4d12bfa8bdc84ef954e8cef8","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"0325d017bf4354a015a02413ee1c7e51266cecf4","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"4c63f29872cb444b33665348bbd2f45cab06afcd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/thunderbolt/xdomain.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.15","status":"affected"},{"version":"0","lessThan":"4.15","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/000189b249e45e63ee873d0c59c3be1805349681","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0325d017bf4354a015a02413ee1c7e51266cecf4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42dddadf6b6131af4d12bfa8bdc84ef954e8cef8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/487ee7dbad21d1e757f5dd490ac182aebfa5f689","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c63f29872cb444b33665348bbd2f45cab06afcd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d6657674919bef57c8a7195170263f3456e9876","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dbc8a8dd7c1930043c473818fcadcf88cb5e1c4d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97511","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.993","lastModified":"2026-09-28T06:16:37.117","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: avoid out-of-bounds access in monitor\n\nIn NAN, we don't know on what band the frame will be sent. Therefore we\nset info->band to NUM_NL80211_BANDS. However, this leads to out-of-bound\naccess in ieee80211_add_tx_radiotap_header when we try to access the\nsbands array.\n\nFix it by not accessing the array if the band is NUM_NL80211_BANDS.\nThis means that we will not report rate info for legacy rate in NAN.\nBut nobody really cares about it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/status.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fc41f4a28ac4d462487903229494eeb266f68a40","lessThan":"7f087f70e020b16a5b967332ee6e937817eaa173","versionType":"git","status":"affected"},{"version":"fc41f4a28ac4d462487903229494eeb266f68a40","lessThan":"03c41203ee5a833a9d7a7630be190830cede29d8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/status.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/03c41203ee5a833a9d7a7630be190830cede29d8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f087f70e020b16a5b967332ee6e937817eaa173","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97512","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.100","lastModified":"2026-10-03T11:18:00.740","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-qcom-qspi: Fix incomplete error handling in runtime PM\n\nThe runtime PM functions had incomplete error handling that could leave the\nsystem in an inconsistent state. If any operation failed midway through\nsuspend or resume, some resources would be left in the wrong state while\nothers were already changed, leading to potential clock/power imbalances.\n\nReorder the suspend/resume sequences to avoid brownout risk by ensuring the\nperformance state is set appropriately before clocks are enabled and clocks\nare disabled before dropping the performance state.\n\nFix by adding proper error checking for all operations and using goto-based\ncleanup to ensure all successfully acquired resources are properly released\non any error."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/spi/spi-qcom-qspi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cff80645d6d3134260d2ef007a7decb1edcfd4a6","lessThan":"d9fa79ccd09204f626d382bdde1b8f5f4c5d03b3","versionType":"git","status":"affected"},{"version":"cff80645d6d3134260d2ef007a7decb1edcfd4a6","lessThan":"62dd3b8d3a92eb4e080b2ae491c2a5341654c1ee","versionType":"git","status":"affected"},{"version":"cff80645d6d3134260d2ef007a7decb1edcfd4a6","lessThan":"bb18a346271f87889bd64a3861c9a656a3509ea6","versionType":"git","status":"affected"},{"version":"cff80645d6d3134260d2ef007a7decb1edcfd4a6","lessThan":"d283d5d4d9f6d081ddb65e371be26fffeb611c42","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/spi/spi-qcom-qspi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.9","status":"affected"},{"version":"0","lessThan":"5.9","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/62dd3b8d3a92eb4e080b2ae491c2a5341654c1ee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb18a346271f87889bd64a3861c9a656a3509ea6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d283d5d4d9f6d081ddb65e371be26fffeb611c42","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9fa79ccd09204f626d382bdde1b8f5f4c5d03b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97513","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.210","lastModified":"2026-10-21T13:21:11.510","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Release m2m_ctx after Instance Removed from List\n\nPossible use after free if IRQ thread manages to obtain spinlock between\nm2m_ctx release and wave5_release function removing stream instance from\nlist of active instances. The IRQ thread looks for the m2m_ctx which is\nfreed so null pointer dereference occurs."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/media/platform/chips-media/wave5/wave5-helper.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9707a6254a8a6b978bde811a44fe07d86c229d1c","lessThan":"0e6bdd437a3c7a5d8846d7f58fe9645a60ec0933","versionType":"git","status":"affected"},{"version":"9707a6254a8a6b978bde811a44fe07d86c229d1c","lessThan":"04cda0b5c4ca3f61cbc86e41ead3c462c8cfd659","versionType":"git","status":"affected"},{"version":"9707a6254a8a6b978bde811a44fe07d86c229d1c","lessThan":"7cdbd7bb21949a8fda10c7104a2b12ee363cbf5c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/media/platform/chips-media/wave5/wave5-helper.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/04cda0b5c4ca3f61cbc86e41ead3c462c8cfd659","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0e6bdd437a3c7a5d8846d7f58fe9645a60ec0933","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cdbd7bb21949a8fda10c7104a2b12ee363cbf5c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97514","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.323","lastModified":"2026-09-28T06:16:37.423","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Fix Reports from Kernel Lock Validator\n\nhandle_dynamic_resolution change requires that the state_lock be acquired\nbased on the lockdep_assert_held. However, the\nhandle_dynamic_resolution_change call in initialize_sequence does not\nproperly obtain the lock before calling.\n\nSince the v4l2_ctrl_find and s_ctrl can sleep, they should not be called\nwhile a lock is already held. Store off the fbc_buf_count then properly\nupdate control once lock has been freed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9707a6254a8a6b978bde811a44fe07d86c229d1c","lessThan":"629a937091ecf9c5c9f7a18f41cb0e6c778a7b2f","versionType":"git","status":"affected"},{"version":"9707a6254a8a6b978bde811a44fe07d86c229d1c","lessThan":"072beef6a19f9c84dc5a50c5499663a5734c1096","versionType":"git","status":"affected"},{"version":"9707a6254a8a6b978bde811a44fe07d86c229d1c","lessThan":"7d5d364f8b2dcc9b6b92456fb55632fde4a4d96f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/072beef6a19f9c84dc5a50c5499663a5734c1096","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/629a937091ecf9c5c9f7a18f41cb0e6c778a7b2f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d5d364f8b2dcc9b6b92456fb55632fde4a4d96f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97515","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.440","lastModified":"2026-10-21T13:21:11.650","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845\n\nOn NPCM845, when a target on the I3C bus gets stuck holding SDA low,\nthe controller reports a false Master Request (MR) in-band interrupt\nevent. The driver handles this by emitting a STOP condition to restore\nthe bus.\n\nHowever, the hardware quirk SVC_I3C_QUIRK_FALSE_SLVSTART indicates that\nemitting a STOP condition may spuriously set the SLVSTART interrupt\nstatus bit. In the Master Request case, this creates a feedback loop:\nthe STOP triggers a new SLVSTART event, the IRQ handler fires again,\nthe controller still reports an MR type, another STOP is emitted, and\nthe cycle repeats indefinitely, resulting in an IRQ storm that can lock\nup the CPU.\n\nClear the SLVSTART status bit explicitly after emitting the STOP in the\nMaster Request IBI handler when the SVC_I3C_QUIRK_FALSE_SLVSTART quirk\nis set. This breaks the feedback loop without affecting normal SLVSTART\nprocessing, which is already guarded in the top-level IRQ handler by\nchecking that MSTATUS is in SLVREQ state."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/i3c/master/svc-i3c-master.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1ea4653cff35c29d1dd0b14ad9c8245e7318f337","lessThan":"335f72b1f9bbcf0f4cc5a505443b15f1af563b4f","versionType":"git","status":"affected"},{"version":"0430bf9bc1ac068c8b8c540eb93e5751872efc51","lessThan":"e9b139c4684ed8593a0b779ca02ea05f460b2eec","versionType":"git","status":"affected"},{"version":"0430bf9bc1ac068c8b8c540eb93e5751872efc51","lessThan":"1effa3adfe53cb2bb28bf5640a676b791d5ab405","versionType":"git","status":"affected"},{"version":"30748ce7e156f221fb91689b338a0d7df77b732a","versionType":"git","status":"affected"},{"version":"f2985a1de6f53abbc42c7a696ee6ba8bdecc9426","versionType":"git","status":"affected"},{"version":"0541822045ae043d62c941ca31fa76871e436b5e","versionType":"git","status":"affected"},{"version":"d231fb443d8d4042f0dd705b93beba8c916a7344","versionType":"git","status":"affected"},{"version":"6.12.31","lessThan":"6.12.114","versionType":"semver","status":"affected"},{"version":"5.15.185","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.141","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.6.93","lessThan":"6.7","versionType":"semver","status":"affected"},{"version":"6.14.9","lessThan":"6.15","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/i3c/master/svc-i3c-master.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1effa3adfe53cb2bb28bf5640a676b791d5ab405","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/335f72b1f9bbcf0f4cc5a505443b15f1af563b4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9b139c4684ed8593a0b779ca02ea05f460b2eec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97516","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.550","lastModified":"2026-10-03T11:18:00.840","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()\n\nIt was recently reported that rtw_fw_adaptivity_result()\nin fw.c dereferences rtwdev->chip->edcca_th without\na NULL check. The issue is that devices with the\n8821CE chip don't define edcca_th in their chip\ninfo. As a result, when rtw_fw_adaptivity_result()\ntries to dereference it, the kernel triggers an oops.\n\nAdd a NULL check for edcca_th before dereferencing\nit in rtw_fw_adaptivity_result() in fw.c. Placing\nthe check at the function entry avoids logging any\ngarbage values.\n\nThis change does not address the root cause for\nthis behavior, but it prevents the NULL dereference\nand the resulting oops while a more permanent solution\nis developed.\n\nTested on a 8822CE chip which defines edcca_th, so\nthis issue is not present on it, but it still uses\nthis driver and I can verify there are no regressions."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/realtek/rtw88/fw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130","lessThan":"a8cdb18ef80d67790d8611ba94ae3d81901c9e04","versionType":"git","status":"affected"},{"version":"fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130","lessThan":"0b58a5ac9170a6f5e6425f8e1a4b3e1d9c2bf53d","versionType":"git","status":"affected"},{"version":"fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130","lessThan":"6fa23cafaf30f4877e357f8eebcff00dff4aa9cb","versionType":"git","status":"affected"},{"version":"fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130","lessThan":"1d1f250432cd8704c3c125168887f9724021c81a","versionType":"git","status":"affected"},{"version":"fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130","lessThan":"d5e6f353ce1e1c25b8458ea390ed09d2377412c5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/realtek/rtw88/fw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0b58a5ac9170a6f5e6425f8e1a4b3e1d9c2bf53d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1d1f250432cd8704c3c125168887f9724021c81a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fa23cafaf30f4877e357f8eebcff00dff4aa9cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8cdb18ef80d67790d8611ba94ae3d81901c9e04","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5e6f353ce1e1c25b8458ea390ed09d2377412c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97517","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.670","lastModified":"2026-10-03T11:18:00.950","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: reject beacons with bad HE operation\n\nThe HE operation element not only needs to be longer than\nthe fixed part, but also have an appropriate size for the\nvariable part inside of it. Check this."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/nl80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7e8d6f12bb2a729290ebb0096248ea46d2868fc6","lessThan":"6e24f72985782013bf2feb0f0712b2ac9390e909","versionType":"git","status":"affected"},{"version":"7e8d6f12bb2a729290ebb0096248ea46d2868fc6","lessThan":"8fe5eb7b68d76b3801409ada7365c67696e7af84","versionType":"git","status":"affected"},{"version":"7e8d6f12bb2a729290ebb0096248ea46d2868fc6","lessThan":"6c4bb5450b9d9111faaaba581ea45a3a79844e50","versionType":"git","status":"affected"},{"version":"7e8d6f12bb2a729290ebb0096248ea46d2868fc6","lessThan":"0d635f0b4a634eb599ed13a87ece0b5f129f9900","versionType":"git","status":"affected"},{"version":"7e8d6f12bb2a729290ebb0096248ea46d2868fc6","lessThan":"8b9a100e1a76c52988b31099b349fd95a58c8768","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/nl80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0d635f0b4a634eb599ed13a87ece0b5f129f9900","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6c4bb5450b9d9111faaaba581ea45a3a79844e50","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e24f72985782013bf2feb0f0712b2ac9390e909","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b9a100e1a76c52988b31099b349fd95a58c8768","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8fe5eb7b68d76b3801409ada7365c67696e7af84","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97518","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.787","lastModified":"2026-10-21T13:21:11.790","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: reject duplicate wiphy cipher suite entries\n\nDuplicate entries in wiphy->cipher_suites do not describe any\nadditional capability, but cfg80211 currently accepts them and leaves\nindividual consumers to deal with them.\n\nOne such consumer is the WEXT compatibility code, which appends a WEP\nkey length for each WEP cipher entry it sees. Repeated WEP entries can\ntherefore overflow the fixed iw_range::encoding_size array returned by\nSIOCGIWRANGE.\n\nReject duplicate cipher suite entries in wiphy_register() instead.\nThis keeps the cipher suite invariant in one place and makes malformed\nwiphy descriptions fail early with -EINVAL, rather than relying on a\nsingle cfg80211 user to handle duplicates correctly."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2ab658f9ce218ae93b3d2db2b3fe68bfefb81196","lessThan":"d12e92e72db914e1ea777c6f246f6be75985438e","versionType":"git","status":"affected"},{"version":"2ab658f9ce218ae93b3d2db2b3fe68bfefb81196","lessThan":"1305f8b925fe92edf5fec183588dfc7db719180b","versionType":"git","status":"affected"},{"version":"2ab658f9ce218ae93b3d2db2b3fe68bfefb81196","lessThan":"4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923","versionType":"git","status":"affected"},{"version":"2ab658f9ce218ae93b3d2db2b3fe68bfefb81196","lessThan":"7187d145d9042b037e4f10538f70cf95e380219f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","lessThan":"2.6.32","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1305f8b925fe92edf5fec183588dfc7db719180b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7187d145d9042b037e4f10538f70cf95e380219f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d12e92e72db914e1ea777c6f246f6be75985438e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97519","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.923","lastModified":"2026-09-28T06:16:37.937","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix null pointer dereference in devcoredump cleanup\n\nIn xe_devcoredump_snapshot_free(), ss->gt may be NULL when the snapshot\nwas never fully populated (e.g., when cleanup is triggered without a\nprior capture). Guard the xe_guc_capture_put_matched_nodes() call with\nIS_ERR_OR_NULL() to prevent a null dereference.\n\nIn xe_devcoredump_free(), the deferred work is only queued when a\ncoredump is captured, so guard cancel_work_sync() with a check on\ncoredump->captured."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/xe/xe_devcoredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ecb6336463911d6eb684998754f8701d0f437f18","lessThan":"f5c3144f783f91d74b4fae84fb8bd7a4edf001f8","versionType":"git","status":"affected"},{"version":"ecb6336463911d6eb684998754f8701d0f437f18","lessThan":"12ef528d78adc8ea4e7e3db594f3bcac327e79fa","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/xe/xe_devcoredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/12ef528d78adc8ea4e7e3db594f3bcac327e79fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5c3144f783f91d74b4fae84fb8bd7a4edf001f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97520","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:30.050","lastModified":"2026-09-28T06:16:38.047","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: move quota_init qc iterator increment\n\nMove qc++ from the loop body into the for-loop increment\nexpression in gfs2_quota_init().\n\nThis keeps iterator progression explicit and avoids mixing pointer\nadvance with duplicate-slot handling in the loop body."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/gfs2/quota.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"de0d95c26c41c1776e4d23b1a8b3f2bcfd1dae5f","lessThan":"04ec2f3b29b3c8a59950b8816b5ebc8ba052808a","versionType":"git","status":"affected"},{"version":"de0d95c26c41c1776e4d23b1a8b3f2bcfd1dae5f","lessThan":"21a50a9373adab35ffadf5cf59272dc99078170e","versionType":"git","status":"affected"},{"version":"de0d95c26c41c1776e4d23b1a8b3f2bcfd1dae5f","lessThan":"942202677f8f2ee448a6a2feb06aeeaf520342e3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/gfs2/quota.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/04ec2f3b29b3c8a59950b8816b5ebc8ba052808a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/21a50a9373adab35ffadf5cf59272dc99078170e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/942202677f8f2ee448a6a2feb06aeeaf520342e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97521","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:30.160","lastModified":"2026-09-28T06:16:38.160","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fix quota init duplicate scan\n\ngfs2_quota_init() checks for duplicate quota_change IDs while holding\nqd_lock and the quota hash bucket bitlock. That path used\ngfs2_qd_search_bucket(), which takes a lockref reference via\nlockref_get_not_dead().\n\nOn PREEMPT_RT this may sleep, which is not allowed under the bucket\nbitlock, triggering \"sleeping function called from invalid context\".\n\nUse a no-ref bucket lookup in this path, then continue duplicate\nhandling without taking a lockref there.\n\nRefactor gfs2_qd_search_bucket() to build on top of the no-ref helper\nso lookup traversal stays in one place.\n\nThis patch fixes a bug reported by syzbot."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/gfs2/quota.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"de0d95c26c41c1776e4d23b1a8b3f2bcfd1dae5f","lessThan":"7fdcf16e5e14e11028f5bcaa6d25075eb5e876a0","versionType":"git","status":"affected"},{"version":"de0d95c26c41c1776e4d23b1a8b3f2bcfd1dae5f","lessThan":"812a766e2b0a8f4d094393fad13475c57f5f86db","versionType":"git","status":"affected"},{"version":"de0d95c26c41c1776e4d23b1a8b3f2bcfd1dae5f","lessThan":"b99a1f0f18ee50445907f55069e88bcfd8947383","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/gfs2/quota.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/7fdcf16e5e14e11028f5bcaa6d25075eb5e876a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/812a766e2b0a8f4d094393fad13475c57f5f86db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b99a1f0f18ee50445907f55069e88bcfd8947383","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-54461","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:13.820","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a computationally expensive regular expression that degrades application performance or halts Node.js processes. This issue is fixed in version 5.48.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"HabitRPG","product":"habitica","versions":[{"version":">= 4.172.1, < 5.48.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:57:09.073378Z","id":"CVE-2026-54461","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/HabitRPG/habitica/commit/7b7dc255dff1564935675399ff168e8a91b8afca","source":"security-advisories@github.com"},{"url":"https://github.com/HabitRPG/habitica/releases/tag/v5.48.2","source":"security-advisories@github.com"},{"url":"https://github.com/HabitRPG/habitica/security/advisories/GHSA-x772-22c9-gq58","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-57175","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:14.523","lastModified":"2026-10-05T16:17:14.443","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account. The attacker could then authenticate through SAML and gain access to the victim's account. The issue affects applications using the SAML backend together with authenticated account association. The issue has been fixed in version 5.0.0 by validating SAML responses against stored `AuthnRequest` IDs."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"python-social-auth","product":"social-core","versions":[{"version":"< 5.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:53:05.460192Z","id":"CVE-2026-57175","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-vq6g-g6c7-5f2j","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-57176","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:14.680","lastModified":"2026-09-29T03:17:16.433","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"python-social-auth","product":"social-core","versions":[{"version":"< 5.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:58:12.222463Z","id":"CVE-2026-57176","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-289"}]}],"references":[{"url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-fp7w-m676-w7gc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-57177","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:14.823","lastModified":"2026-10-05T16:17:14.560","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victim authenticated as the attacker's LoginRadius identity. The issue affects only applications using the LoginRadius backend. The issue has been fixe in version 5.0.0 by enabling callback state validation for the LoginRadius backend."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"python-social-auth","product":"social-core","versions":[{"version":"< 5.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:05.660534Z","id":"CVE-2026-57177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-x7qq-23vw-7pfg","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-57178","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:14.970","lastModified":"2026-09-28T18:17:23.873","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data without verifying the callback signature when the `auth_key` parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as `viewer_id`, `access_token`, `api_id`, and `api_result`, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the `vk-app` backend. The issue has been fixed in version 5.0.0 by requiring `auth_key` to be present and valid before callback data is trusted."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"python-social-auth","product":"social-core","versions":[{"version":"< 5.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:34:29.013431Z","id":"CVE-2026-57178","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-3c93-f73f-qc9h","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-57179","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:15.120","lastModified":"2026-09-30T17:23:08.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted `partial_token` as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and verification data, and cause a victim's browser to resume that attacker-controlled flow. This could authenticate the victim's browser as the attacker's account. The issue affects applications using partial pipeline steps such as `mail_validation` or custom steps decorated with `@partial`. The issue has been fixed in version 5.0.0 by binding partial pipeline resumes to the originating browser session."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"python-social-auth","product":"social-core","versions":[{"version":"< 5.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:10:50.898479Z","id":"CVE-2026-57179","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-384"}]}],"references":[{"url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-vqg6-3fw6-j9jg","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61604","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:15.707","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and MsgWithdrawShare, as well as the batch order processor. Because any account may list an arbitrary blockchainAccountID as a verification method on a DID it controls (without the consent of that address's owner), an attacker could register victims' addresses as verification methods on their own DID and then move the victims' balances into a bond the attacker controlled — later withdrawing and bridging the proceeds off-chain. This was exploited on ixo mainnet (ixo-5) on 2026-06-20. The attack required no victim keys, signatures, or system compromise — any account holding a balance in a token a bond could use was at risk. This was fixed in v8.0.0, delivered via the on-chain v8 software-upgrade. The x/bonds module is disabled: every bonds message is rejected on all routes (top-level, authz, CosmWasm, and ICA), and the bonds batch EndBlocker is a no-op so no further reserve movements can occur. All node operators and validators must upgrade to v8.0.0. The flaw is in chain state-machine logic and can only be remediated by running the patched binary. There is no application-level workaround. The vulnerability is in consensus logic; remediation requires the network to run the patched (v8.0.0) binary. The bonds module remains disabled in v8.0.0 and will only be re-enabled in a future release once the signer-authorization model has been corrected."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"ixofoundation","product":"ixo-blockchain","versions":[{"version":"< 8.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:02:22.273058Z","id":"CVE-2026-61604","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/ixofoundation/ixo-blockchain/security/advisories/GHSA-w3rp-4cm2-4wgc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61732","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:15.860","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"BitterSecurity","product":"Decepticon","versions":[{"version":"< 1.1.17","status":"affected"}]},{"vendor":"BitterSecurity","product":"decepticon-core","versions":[{"version":"< 1.1.17","status":"affected"}]},{"vendor":"BitterSecurity","product":"decepticon-sdk","versions":[{"version":"< 1.1.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:59:08.643777Z","id":"CVE-2026-61732","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"references":[{"url":"https://github.com/BitterSecurity/Decepticon/commit/79ee2aaf22f4c36a5b1968f6ca3f8086b6e35b67","source":"security-advisories@github.com"},{"url":"https://github.com/BitterSecurity/Decepticon/security/advisories/GHSA-g5f9-3xfg-p9mf","source":"security-advisories@github.com"},{"url":"https://github.com/BitterSecurity/Decepticon/security/advisories/GHSA-g5f9-3xfg-p9mf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-61741","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:16.013","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a `javax.xml.parsers.SAXParserFactory` obtained from `SAXParserFactory.newInstance` without any security configuration.  With the JDK's default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.An application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks.  An attacker can craft a request that discloses local files readable by the service process, performs server-side request forgery (SSRF) against internal network resources, and/or causes denial of service through entity expansion. Versions 0.24.1 and 1.0.0-M39 fix the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"http4s","product":"http4s-scala-xml","versions":[{"version":"< 0.24.1","status":"affected"},{"version":">= 1.0.0-M1, < 1.0.0-M39","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:01:50.360279Z","id":"CVE-2026-61741","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-611"}]}],"references":[{"url":"https://github.com/http4s/http4s-scala-xml/security/advisories/GHSA-cjx3-73hr-rpw7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61742","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:16.173","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `--transport http --port 8080`. The HTTP server attempts to protect browser-origin access by checking whether the `Origin` hostname equals the `Host` hostname, then reflecting the validated `Origin` into `Access-Control-Allow-Origin`. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both `Origin` and `Host` can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls. As a result, a malicious website can deterministically invoke DBHub MCP tools from the victim's browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub's configured tool permissions and database credentials. Version 0.22.5 fixes the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"bytebase","product":"dbhub","versions":[{"version":"< 0.22.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:42:02.587147Z","id":"CVE-2026-61742","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-346"}]}],"references":[{"url":"https://github.com/bytebase/dbhub/security/advisories/GHSA-fm8p-53ww-hf6w","source":"security-advisories@github.com"},{"url":"https://github.com/bytebase/dbhub/security/advisories/GHSA-fm8p-53ww-hf6w","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-61782","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:16.333","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interfaces (`0.0.0.0`) and serves a `POST /api/data/key` endpoint with no authentication and wildcard CORS (`Access-Control-Allow-Origin: *`). Any network-adjacent or remote attacker can send a single unauthenticated request to retrieve the full source code of all compiled JavaScript modules (`moduleCodeMap`), serialized build configuration (`configs`), error details, and other sensitive build metadata. This server is enabled by default in non-CI environments, requiring no special configuration from the victim developer. Version 1.5.16 patches the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"web-infra-dev","product":"rsdoctor","versions":[{"version":"< 1.5.16","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:59:04.166140Z","id":"CVE-2026-61782","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/web-infra-dev/rsdoctor/security/advisories/GHSA-jmg2-rcxh-w8q3","source":"security-advisories@github.com"},{"url":"https://github.com/web-infra-dev/rsdoctor/security/advisories/GHSA-jmg2-rcxh-w8q3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-61784","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:16.640","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString() (XHTMLPurifier.js, around line 148) the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any allowed attribute (class, style, title, alt, src, href) can include a double-quote character to break out of the attribute and inject an additional attribute, such as a JavaScript event handler (for example onmouseover or onerror). The injected handler survives sanitization and executes when the output is rendered, which is a sanitizer bypass leading to cross-site scripting. The fix in version 0.4.3 HTML-entity-encodes attribute values before serialization."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"cstigler","product":"node-xhtml-purifier","versions":[{"version":"< 0.4.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:02:51.787487Z","id":"CVE-2026-61784","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}]}],"references":[{"url":"https://github.com/cstigler/node-xhtml-purifier/commit/21d461ad23e7bc9b3073693d5b51b9b8662044d3","source":"security-advisories@github.com"},{"url":"https://github.com/cstigler/node-xhtml-purifier/security/advisories/GHSA-j8r4-32c5-33rc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61788","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:16.837","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default_transaction_read_only=on` (and open SQLite in `readOnly` mode), but that code is gated on a config value that is never populated, so it never runs. The only thing left enforcing read-only is a classifier that inspects the first keyword of each statement. Any `SELECT` that writes or has side effects through a function call passes it. With an ordinary role this allows sequence tampering; with a privileged role it allows writing arbitrary files on the server (`lo_export`), reading arbitrary host files (`pg_read_file`), and remote code execution (`dblink` + `COPY ... TO PROGRAM`). The HTTP transport is unauthenticated and binds to `0.0.0.0` by default, so this is reachable by any network caller of `/mcp`. Version 0.22.6 patches the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"bytebase","product":"dbhub","versions":[{"version":"< 0.22.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:00:20.390455Z","id":"CVE-2026-61788","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-184"},{"lang":"en","value":"CWE-636"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/bytebase/dbhub/security/advisories/GHSA-mwwr-p57h-56pf","source":"security-advisories@github.com"},{"url":"https://github.com/bytebase/dbhub/security/advisories/GHSA-mwwr-p57h-56pf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-61811","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:16.990","lastModified":"2026-09-30T16:44:39.840","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattributes() function in src/os_xml/os_xml.c recursively processes every XML attribute without a depth limit while allocating two large local buffers in each stack frame. An enrolled agent can submit a Windows EventChannel event containing an element with enough attributes to exhaust the analysisd worker-thread stack, trigger a segmentation fault, and interrupt log ingestion. The element-depth limit in _ReadElem() does not constrain the number of attributes on one element, so it does not prevent this condition. This issue is fixed in version 4.14.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"wazuh","product":"wazuh","versions":[{"version":">= 3.8.0, < 4.14.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:02:16.205270Z","id":"CVE-2026-61811","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://github.com/wazuh/wazuh/commit/2ac70941c5980a5dd24ad8a0f2be559f840e6a67","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/pull/37147","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.7","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-9wv5-7qwx-m9w5","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-9wv5-7qwx-m9w5","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-61815","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:17.153","lastModified":"2026-10-05T16:17:14.673","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF (carriage-return / line-feed) header injection (CWE-93) affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename. Attachment filenames are interpolated into the `Content-Type` and `Content-Disposition` header values without stripping CR/LF, so a filename containing `\\r\\n` serializes as one or more additional, attacker-controlled header lines (for example a forged `Bcc:` that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed. Versions 3.0.6 and 4.0.2 patch the issue. Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\\r\\n]+/', ' ', $filename)."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zbateson","product":"mail-mime-parser","versions":[{"version":"< 3.0.6","status":"affected"},{"version":">= 4.0.0, < 4.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:51:02.739548Z","id":"CVE-2026-61815","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-93"}]}],"references":[{"url":"https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-36h5-qg4p-q2qf","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61816","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:17.303","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Starting in version 2.0.0 and prior to version 3.0.6 and 4.0.2, an uncontrolled resource consumption / algorithmic complexity vulnerability (CWE-400) affects any application that parses untrusted email with this library. Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does **not** bound the work done.  A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first `getAllParts()` or content read. This is fxed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions. Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.) These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zbateson","product":"mail-mime-parser","versions":[{"version":">= 2.0.0, < 3.0.6","status":"affected"},{"version":">= 4.0.0, < 4.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:11:24.169203Z","id":"CVE-2026-61816","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx","source":"security-advisories@github.com"},{"url":"https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-63645","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:19.053","lastModified":"2026-10-05T16:17:14.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hide_sensitive_fields keyword filter. The filter does not recognize dsn or creds field names, so meta_postgres_dsn, meta_postgres_ro_dsn, meta_ddl_dsn, and usage_reporting_creds can be returned in plaintext to an unauthenticated network client. PostgreSQL deployments can expose database credentials, and the same response can disclose the root administrator email address, internal NATS address, filesystem layout, and other deployment details. This issue is fixed in version 0.90.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"openobserve","product":"openobserve","versions":[{"version":"< 0.90.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:51:04.523036Z","id":"CVE-2026-63645","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/openobserve/openobserve/commit/4f3db1cf790ffe8ea065d98f87344e839ec6e477","source":"security-advisories@github.com"},{"url":"https://github.com/openobserve/openobserve/pull/12220","source":"security-advisories@github.com"},{"url":"https://github.com/openobserve/openobserve/releases/tag/v0.90.3","source":"security-advisories@github.com"},{"url":"https://github.com/openobserve/openobserve/security/advisories/GHSA-v496-g5c9-vqxw","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-71540","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:18:31.340","lastModified":"2026-09-30T19:38:27.293","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framework/wazuh/core/cluster/common.py allocates a payload buffer using the size declared in a 20-byte cluster protocol header before Fernet decryption validates the peer. An unauthenticated network peer can declare a payload of up to 256 MiB, stop sending after the header, and retain that allocation until the TCP connection closes. The cluster listener has no application-level per-source connection budget in affected versions, allowing concurrent sockets to multiply memory consumption and potentially terminate the cluster process, disrupt synchronization, and interrupt distributed API forwarding. This issue is fixed in version 4.14.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"wazuh","product":"wazuh","versions":[{"version":">= 3.9.0, < 4.14.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T15:01:49.339177Z","id":"CVE-2026-71540","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/wazuh/wazuh/commit/9a996bc23d28725f6c1f8f7808355d90e20d3382","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/pull/37280","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.7","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-78wx-4r6w-w73f","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-78wx-4r6w-w73f","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-81508","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:18:57.503","lastModified":"2026-09-25T13:17:26.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio source within radio range can send a malformed A2DP media packet to a build with BlueDroid Classic Bluetooth and A2DP sink support enabled, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents. Arbitrary memory disclosure and code execution are not established."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"espressif","product":"esp-idf","versions":[{"version":"= 6.1","status":"affected"},{"version":"= 6.0.1","status":"affected"},{"version":"= 5.5.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:06:01.831759Z","id":"CVE-2026-81508","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/espressif/esp-idf/commit/0d118139ff8b7aa87b656c2f4a6421ecaa1f5939","source":"security-advisories@github.com"},{"url":"https://github.com/espressif/esp-idf/commit/6cb20db4dfeee81314d0c55acb82f3f0e7679abe","source":"security-advisories@github.com"},{"url":"https://github.com/espressif/esp-idf/commit/85d56bcd266117e0fe6a6b75511c8e122fda29ad","source":"security-advisories@github.com"},{"url":"https://github.com/espressif/esp-idf/commit/ca55d63de82e41e2c672bfd2b707fc80911f30ce","source":"security-advisories@github.com"},{"url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-xcpr-5mqp-9qvv","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-85056","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:19:04.040","lastModified":"2026-09-28T15:17:24.163","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zitadel","product":"zitadel","versions":[{"version":">= 4.0.0, < 4.16.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:55:51.988985Z","id":"CVE-2026-85056","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/releases/tag/v4.16.1","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-85057","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:19:04.217","lastModified":"2026-10-05T16:17:16.690","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. The issue affects Actions V1, and host command execution is not established. This issue is fixed in versions 3.4.13 and 4.16.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zitadel","product":"zitadel","versions":[{"version":">= 3.0.0, < 3.4.13","status":"affected"},{"version":">= 4.0.0, < 4.16.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:53:03.930118Z","id":"CVE-2026-85057","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/releases/tag/v3.4.13","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/releases/tag/v4.16.1","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91119","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:19:06.220","lastModified":"2026-09-28T16:17:16.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:59:51.871193Z","id":"CVE-2026-91119","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/20dbf112760eb1d6a58f2e49aeef7546898b6f1c","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/66653c484cfb91bc346f9a326f6945387f17b035","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/77a81c7a3a7ff9e94b355e32b8f379f2d389e05a","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/c4748f651d9d2f3a6dd3106a4d5564536c645168","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-pv3p-p3m9-v8v3","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91120","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:19:06.397","lastModified":"2026-09-24T18:19:06.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:24:51.329319Z","id":"CVE-2026-91120","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91121","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:19:06.583","lastModified":"2026-09-24T18:19:06.720","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:27:35.450393Z","id":"CVE-2026-91121","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-93405","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:19:07.120","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote sender can craft a supported attachment whose converted HTML executes script when a recipient opens quick preview. The preview renderer has no direct Node or Electron access, but injected script can reach the IPC surface exposed to the quick-preview renderer. This issue alone provides script execution in the preview renderer; separate path-traversal and renderer-controlled file-write vulnerabilities are required for the documented persistent code-execution chain. This issue is fixed in version 1.17.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Foundry376","product":"Mailspring","versions":[{"version":"< 1.17.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:02:37.474456Z","id":"CVE-2026-93405","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/Foundry376/Mailspring/commit/5728388199666ec0a9a58f693c89c25b948a9b6c","source":"security-advisories@github.com"},{"url":"https://github.com/Foundry376/Mailspring/pull/2523","source":"security-advisories@github.com"},{"url":"https://github.com/Foundry376/Mailspring/releases/tag/1.17.0","source":"security-advisories@github.com"},{"url":"https://github.com/Foundry376/Mailspring/security/advisories/GHSA-px2g-jhg5-c6gh","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-95985","sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","published":"2026-09-24T18:19:08.357","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths.\n\n\n\nWe recommend you upgrade to Kiro IDE version 1.0.242 or later. Users who ran the agent in an untrusted workspace on an earlier version should also review the global Kiro configuration directory (~/.kiro) for entries they did not create."}],"affected":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","affectedData":[{"vendor":"Amazon","product":"Kiro IDE","defaultStatus":"unaffected","platforms":["MacOS","Windows","Linux"],"versions":[{"version":"0","lessThan":"1.0.242","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:23:54.377945Z","id":"CVE-2026-95985","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","description":[{"lang":"en","value":"CWE-349"},{"lang":"en","value":"CWE-829"}]}],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-117-aws/","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://kiro.dev/changelog/ide/1-0-242/","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}]}},{"cve":{"id":"CVE-2026-97232","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T18:19:09.217","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in volotat Anagnorisis up to 0.4.2. Affected by this vulnerability is the function get_file_content/save_file_content/move_files/start_streaming of the file page.html. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"volotat","product":"Anagnorisis","cpes":["cpe:2.3:a:volotat:anagnorisis:*:*:*:*:*:*:*:*"],"versions":[{"version":"0.4.0","status":"affected"},{"version":"0.4.1","status":"affected"},{"version":"0.4.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:28:23.995827Z","id":"CVE-2026-97232","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://note-hxlab.wetolink.com/share/O7wlVHed7mQd","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97232","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908266","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409322","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409322/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97233","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T18:19:09.410","lastModified":"2026-10-05T16:17:18.033","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument file_path leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"volotat","product":"Anagnorisis","cpes":["cpe:2.3:a:volotat:anagnorisis:*:*:*:*:*:*:*:*"],"modules":["Media Filename Handler"],"versions":[{"version":"0.4.0","status":"affected"},{"version":"0.4.1","status":"affected"},{"version":"0.4.2","status":"affected"},{"version":"0.4.3","status":"affected"},{"version":"0.4.4","status":"affected"},{"version":"0.4.5","status":"affected"},{"version":"0.4.6","status":"affected"},{"version":"0.4.7","status":"affected"},{"version":"0.4.8","status":"affected"},{"version":"0.4.9","status":"affected"},{"version":"0.4.10","status":"affected"},{"version":"0.4.11","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:05:15.350333Z","id":"CVE-2026-97233","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://note-hxlab.wetolink.com/share/qA4ZLotZKWmj","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97233","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908267","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409323","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409323/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-13016","sourceIdentifier":"psirt@servicenow.com","published":"2026-09-24T19:17:11.820","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended. \n\n\n\n\n\nServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."}],"affected":[{"source":"psirt@servicenow.com","affectedData":[{"vendor":"ServiceNow","product":"ServiceNow AI Platform","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"Yokohama Patch 13 Hot Fix 5a","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 3b","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 4a W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 11 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 2 Hot Fix 4b W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 4 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@servicenow.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:13:52.621840Z","id":"CVE-2026-13016","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3159623","source":"psirt@servicenow.com"}]}},{"cve":{"id":"CVE-2026-13248","sourceIdentifier":"psirt@honeywell.com","published":"2026-09-24T19:17:12.917","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows an authenticated user with access to the admin or itadmin account to submit commands written in the Intermec Fingerprint programming language directly to the printer ’s internal command interpreter. \n\n\nAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability."}],"affected":[{"source":"psirt@honeywell.com","affectedData":[{"vendor":"Honeywell","product":"PD45 Industrial Printer","defaultStatus":"unaffected","versions":[{"version":"F10.19.010040","lessThan":"F10.22.030745","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@honeywell.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:19:35.275464Z","id":"CVE-2026-13248","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@honeywell.com","type":"Secondary","description":[{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://www.honeywell.com/us/en/legal/product-security#security-notices","source":"psirt@honeywell.com"}]}},{"cve":{"id":"CVE-2026-13249","sourceIdentifier":"psirt@honeywell.com","published":"2026-09-24T19:17:13.080","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication.\n\n\nAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability."}],"affected":[{"source":"psirt@honeywell.com","affectedData":[{"vendor":"Honeywell","product":"PD45 Industrial Printer","defaultStatus":"unaffected","versions":[{"version":"F10.19.010040","lessThan":"F10.22.030745","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@honeywell.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:37:57.888525Z","id":"CVE-2026-13249","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@honeywell.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://www.honeywell.com/us/en/legal/product-security#security-notices","source":"psirt@honeywell.com"}]}},{"cve":{"id":"CVE-2026-48070","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:13.430","lastModified":"2026-10-05T16:17:13.640","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docmost","product":"docmost","versions":[{"version":"< 0.80.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:02.411616Z","id":"CVE-2026-48070","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/releases/tag/v0.80.1","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-95f8-h5hf-8248","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-48072","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:13.597","lastModified":"2026-09-24T19:17:13.730","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated attacker can traverse outside the avatar or logo directory and read local storage objects whose final basename satisfies the route's UUID check. This issue is fixed in version 0.80.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docmost","product":"docmost","versions":[{"version":"< 0.80.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:47:04.473169Z","id":"CVE-2026-48072","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/commit/ec83fc82d54bf3728eaa63b20eb4abcb5aef1d97","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/releases/tag/v0.80.1","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-9f58-29hm-mgp2","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-48073","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:13.767","lastModified":"2026-09-24T20:17:29.000","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with includeAttachments=true causes the page export flow to read the restricted attachment from storage and include it in the returned ZIP archive even though direct file download denies access. This issue is fixed in version 0.80.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docmost","product":"docmost","versions":[{"version":">= 0.70.0, < 0.80.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:23:15.132872Z","id":"CVE-2026-48073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/releases/tag/v0.80.1","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-rxm9-xp9h-4c84","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-52850","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:13.930","lastModified":"2026-09-29T04:17:56.370","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docmost","product":"docmost","versions":[{"version":"< 0.90.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:08:11.300076Z","id":"CVE-2026-52850","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/docmost/docmost/commit/830b5b4d458a1302f42c8b68bff9ff559f6eb342","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/releases/tag/v0.90.1","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-5vhf-cgf2-c9cq","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-52853","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:14.100","lastModified":"2026-10-05T16:17:14.100","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges above their own. When the invitation is accepted, the new account receives OWNER-level permissions, allowing the ADMIN to create a backdoor OWNER account or promote a colluding external user to the workspace's highest privilege level. This issue is fixed in version 0.90.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docmost","product":"docmost","versions":[{"version":"< 0.90.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","baseScore":5.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:00.477232Z","id":"CVE-2026-52853","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/docmost/docmost/commit/33895b060790358869f54ae451c3848480b39503","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/pull/2250","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/releases/tag/v0.90.1","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-84fx-mvqx-p5gx","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-56792","sourceIdentifier":"security_alert@emc.com","published":"2026-09-24T19:17:14.290","lastModified":"2026-09-29T04:17:56.743","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Rugged Control Center (RCC)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.2.206","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T00:00:00+00:00","id":"CVE-2026-56792","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000506924/dsa-2026-410-security-update-for-dell-rugged-control-center-rcc-multiple-vulnerabilities","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-57440","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:14.630","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Version 4.1.0 contains a patch."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"StarCitizenWiki","product":"mediawiki-extensions-EmbedVideo","versions":[{"version":"< 4.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:08:51.593598Z","id":"CVE-2026-57440","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/370156335b325bb81d14d89edf0a1f2643d50a84","source":"security-advisories@github.com"},{"url":"https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-v65j-hff3-753c","source":"security-advisories@github.com"},{"url":"https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-v65j-hff3-753c","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-61823","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:15.350","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the `srcdoc` attribute on iframe elements. Although markup inside `srcdoc` is HTML-encoded during sanitization, browsers decode attribute entities before interpreting the iframe document, allowing an authenticated user with permission to edit an Editor field to store executable JavaScript that runs when another user views the content. Successful exploitation can result in session hijacking, unauthorized actions, account takeover, privilege escalation, or disclosure of administrative data. Version 9.22.5 patches the vulnerability by removing `srcdoc` from the permitted iframe attributes. As a workaround, applications that cannot upgrade should manually sanitize all Editor field content and remove every iframe `srcdoc` attribute before storing or rendering it."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"code16","product":"sharp","versions":[{"version":"< 9.22.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:27:39.971450Z","id":"CVE-2026-61823","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/code16/sharp/commit/ec509a22c808a5bd9dfad6a0a85c92ce6f411e21","source":"security-advisories@github.com"},{"url":"https://github.com/code16/sharp/security/advisories/GHSA-qxg3-46rw-79j8","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61825","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:15.500","lastModified":"2026-09-29T19:07:47.037","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in `SharpEditorFormField`: attacker-controlled content bearing the `data-html-content` attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. The vendor identifies version 9.22.5 as patched; applications that intentionally enable `SharpFormEditorField::RAW_HTML` must continue to sanitize editor content themselves. As a workaround, applications should sanitize all editor content before storing or rendering it, for example with Symfony HtmlSanitizer, and disable RAW_HTML functionality where it is not required."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"code16","product":"sharp","versions":[{"version":"< 9.22.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:53:19.093005Z","id":"CVE-2026-61825","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/code16/sharp/commit/ec509a22c808a5bd9dfad6a0a85c92ce6f411e21","source":"security-advisories@github.com"},{"url":"https://github.com/code16/sharp/security/advisories/GHSA-vj3q-vp3g-j9c8","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-62286","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:15.657","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returned by GET /api/events/stream. In a simple-auth deployment using per-user filters, any authenticated restricted account can receive resource telemetry and lifecycle events for containers outside its authorized label scope. The exposed data includes container names, images, full label maps, CPU and memory use, network and disk totals, and deployment or restart activity across monitored hosts, but does not include log contents, environment values, or exec access. This issue is fixed in version 10.6.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"amir20","product":"dozzle","versions":[{"version":"< 10.6.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:53:09.722694Z","id":"CVE-2026-62286","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/amir20/dozzle/commit/19c01e0fb491c170796edba3da2692562c204e77","source":"security-advisories@github.com"},{"url":"https://github.com/amir20/dozzle/pull/4803","source":"security-advisories@github.com"},{"url":"https://github.com/amir20/dozzle/releases/tag/v10.6.7","source":"security-advisories@github.com"},{"url":"https://github.com/amir20/dozzle/security/advisories/GHSA-xcw9-qmmf-vqxj","source":"security-advisories@github.com"},{"url":"https://github.com/amir20/dozzle/security/advisories/GHSA-xcw9-qmmf-vqxj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-65827","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:15.947","lastModified":"2026-09-24T20:17:29.903","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or entry count. The extractor writes entries to the server temp directory and automatically extracts one nested ZIP, allowing an outer upload within the default 200 MB limit to expand by multiple GB. The resulting disk exhaustion can crash the import worker and degrade or take down the instance for all tenants. This issue is fixed in version 0.95.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docmost","product":"docmost","versions":[{"version":">= 0.21.0, < 0.95.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:22:03.264160Z","id":"CVE-2026-65827","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-409"},{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/docmost/docmost/commit/04110884b4e90a43cc5b337e063d0b7493be5da7","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/releases/tag/v0.95.0","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-frjw-66gr-799m","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-77293","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:16.397","lastModified":"2026-09-25T13:17:26.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and file identifiers without requiring the file to belong to that trip. A user with edit access to any trip can submit identifiers belonging to another user's trip and permanently delete that note-file attachment. Sequential identifiers make broad targeting practical, while attachment read operations remain trip-scoped and are not affected. This issue is fixed in version 3.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mauriceboe","product":"TREK","versions":[{"version":"< 3.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:44:45.227942Z","id":"CVE-2026-77293","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/pull/1520","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/releases/tag/v3.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-cjc5-722j-vvmf","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-cjc5-722j-vvmf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-77294","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:16.570","lastModified":"2026-09-25T13:17:26.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llm_base_url through the settings API when the LLM_PARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted import path. The value is consumed by the clients in server/src/nest/llm-parse/clients/openai-compatible.client.ts, server/src/nest/llm-parse/clients/anthropic.client.ts, and server/src/nest/llm-parse/router/ollama-format.client.ts without applying the server-side request forgery guard. Triggering AI-assisted trip parsing causes the server to request the supplied destination, and upstream error response text can be returned in parsing warnings. This permits internal service discovery and access to link-local cloud metadata, with possible disclosure of infrastructure credentials and subsequent modification of protected cloud resources. This issue is fixed in version 3.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mauriceboe","product":"TREK","versions":[{"version":"< 3.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:35:19.739164Z","id":"CVE-2026-77294","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/pull/1520","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/releases/tag/v3.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-fmq9-ggh3-647p","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-fmq9-ggh3-647p","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-77320","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:16.730","lastModified":"2026-09-29T04:17:58.450","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables share_map. The client hides the map, but the public JSON response still includes the itinerary and place names, coordinates, addresses, descriptions, notes, and prices. Anyone holding the valid share token can therefore read location and route information that the owner explicitly chose not to share, although the random token remains required and the flaw does not permit modification. This issue is fixed in version 3.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mauriceboe","product":"TREK","versions":[{"version":"< 3.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:05:11.522637Z","id":"CVE-2026-77320","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-602"}]}],"references":[{"url":"https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/pull/1520","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/releases/tag/v3.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-9hc8-p7gm-p7mx","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-9hc8-p7gm-p7mx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-77321","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:16.887","lastModified":"2026-10-05T16:17:16.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring trips:read and returns core trip summary data regardless of the delegated scopes. A token granted only an unrelated capability, such as weather:read, can receive trip metadata, member email addresses from server/src/services/tripService.ts, itinerary days, and accommodations for every trip accessible to the token's user. Cross-user trip authorization remains enforced, but the missing scope check defeats the consented least-privilege boundary and exposes trip content and third-party contact information to an MCP client that was not authorized to read it. This issue is fixed in version 3.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mauriceboe","product":"TREK","versions":[{"version":"< 3.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:04.222887Z","id":"CVE-2026-77321","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/pull/1520","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/releases/tag/v3.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-qvw8-w937-vcmq","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-81455","sourceIdentifier":"security_alert@emc.com","published":"2026-09-24T19:17:17.463","lastModified":"2026-09-24T19:37:47.987","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"ThinOS 10","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"SecurityAddon_2605.10.2766_T10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:54:04.557564Z","id":"CVE-2026-81455","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Primary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000506503/dsa-2026-404-security-update-for-dell-thinos-10-for-multiple-vulnerabilities","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-81473","sourceIdentifier":"security_alert@emc.com","published":"2026-09-24T19:17:17.607","lastModified":"2026-09-29T04:17:58.820","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Rugged Control Center (RCC)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.2.206","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T00:00:00+00:00","id":"CVE-2026-81473","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000506924/dsa-2026-410-security-update-for-dell-rugged-control-center-rcc-multiple-vulnerabilities","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-82157","sourceIdentifier":"security_alert@emc.com","published":"2026-09-24T19:17:17.917","lastModified":"2026-09-25T04:17:48.060","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Protection mechanism bypass and Unauthorized access."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"ThinOS 10","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"SecurityAddon_2605.10.2766_T10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-82157","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000506503/dsa-2026-404-security-update-for-dell-thinos-10-for-multiple-vulnerabilities","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-82371","sourceIdentifier":"sirt@brocade.com","published":"2026-09-24T19:17:18.047","lastModified":"2026-10-01T21:17:25.773","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage exposed authentication details to compromise managed network infrastructure and access active application sessions. This vulnerability affects Brocade SANnav versions before 3.0.1a."}],"affected":[{"source":"sirt@brocade.com","affectedData":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"unaffected","versions":[{"version":"before","lessThan":"3.0.1a","versionType":"Brocade SANnav","status":"affected","changes":[{"at":"3.0.1a","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"sirt@brocade.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:37:39.127028Z","id":"CVE-2026-82371","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sirt@brocade.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38996","source":"sirt@brocade.com"}]}},{"cve":{"id":"CVE-2026-85738","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:18.193","lastModified":"2026-09-28T15:17:24.297","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a transition address embedding a private, loopback, or link-local IPv4 target, and isAlwaysBlocked and isPrivateNetwork classify the address as allowed. In a deployment that routes the applicable transition format, user-facing imports, webhooks, integrations, or plugin egress can reach internal services or cloud metadata and expose returned information. This issue is fixed in version 3.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"liketrek","product":"TREK","versions":[{"version":"< 3.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:51:50.053724Z","id":"CVE-2026-85738","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/liketrek/TREK/commit/a2bd9be184a94997105ce190dad920c41e7b10df","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/pull/1540","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/releases/tag/v3.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-9hpq-mrpx-mcxg","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-9hpq-mrpx-mcxg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-86857","sourceIdentifier":"psirt@servicenow.com","published":"2026-09-24T19:17:18.350","lastModified":"2026-09-25T13:17:16.663","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an authenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access, potentially enabling further unintended access.\n\n\n\n\n\nServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."}],"affected":[{"source":"psirt@servicenow.com","affectedData":[{"vendor":"ServiceNow","product":"ServiceNow AI Platform","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"Yokohama Patch 13 Hot Fix 5a","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 3b","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 4a W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 11 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 2 Hot Fix 4b W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 4 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@servicenow.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:46:00.486580Z","id":"CVE-2026-86857","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3159623","source":"psirt@servicenow.com"}]}},{"cve":{"id":"CVE-2026-86858","sourceIdentifier":"psirt@servicenow.com","published":"2026-09-24T19:17:18.483","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended.\n\n\n\n\n\nIn August 2026, ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."}],"affected":[{"source":"psirt@servicenow.com","affectedData":[{"vendor":"ServiceNow","product":"ServiceNow AI Platform","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"Yokohama Patch 13 Hot Fix 5a","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 3b","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 4a W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 11 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 2 Hot Fix 4b W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 4 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@servicenow.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:14:16.789932Z","id":"CVE-2026-86858","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3159623","source":"psirt@servicenow.com"}]}},{"cve":{"id":"CVE-2026-86859","sourceIdentifier":"psirt@servicenow.com","published":"2026-09-24T19:17:18.603","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an unauthenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access, potentially enabling further unintended access.\n\n\n\n\n\nServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."}],"affected":[{"source":"psirt@servicenow.com","affectedData":[{"vendor":"ServiceNow","product":"ServiceNow AI Platform","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"Yokohama Patch 13 Hot Fix 5a","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 3b","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 4a W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 11 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 2 Hot Fix 4b W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 4 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@servicenow.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:12:32.855907Z","id":"CVE-2026-86859","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3159623","source":"psirt@servicenow.com"}]}},{"cve":{"id":"CVE-2026-86860","sourceIdentifier":"psirt@servicenow.com","published":"2026-09-24T19:17:18.733","lastModified":"2026-09-25T04:17:48.557","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to extract instance data beyond what was intended, resulting in privilege escalation.\n\n\n\n\n\nServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."}],"affected":[{"source":"psirt@servicenow.com","affectedData":[{"vendor":"ServiceNow","product":"ServiceNow AI Platform","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"Yokohama Patch 13 Hot Fix 5a","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 3b","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 4a W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 11 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 2 Hot Fix 4b W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 4 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@servicenow.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-86860","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3159623","source":"psirt@servicenow.com"}]}},{"cve":{"id":"CVE-2026-89325","sourceIdentifier":"cve@rapid7.com","published":"2026-09-24T19:17:19.580","lastModified":"2026-09-26T04:17:49.963","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH.\n\nAssessment content at or below version 0.0.261.0 included a check that invoked the `code` command without a fully qualified path from a process running as SYSTEM. The command was resolved against the machine PATH environment variable at execution time. Where the machine PATH contained a directory writable by non-administrative users and ordered ahead of the legitimate Visual Studio Code installation, a local user could place an executable named `code` in that directory and cause the agent to execute it with SYSTEM privileges.\n\nThe version range above refers to InsightVM assessment content versions, not Insight Agent versions. All Insight Agent versions were affected while running assessment content at or below 0.0.261.0. Assessment content is delivered to all Insight Agents via the Rapid7 Insight Platform independently of the Insight Agent version and is not customer-managed.\n\nThis issue was resolved in assessment content version 0.0.269.0, which was made generally available on September 15, 2026. Remediation was deployed automatically and no customer action is required."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Rapid7","product":"Insight Agent","defaultStatus":"unaffected","modules":["InsightVM assessment content"],"platforms":["Windows"],"versions":[{"version":"0","lessThanOrEqual":"0.0.261.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T00:00:00+00:00","id":"CVE-2026-89325","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-427"}]}],"references":[{"url":"https://docs.rapid7.com/insight/release-notes-2026-september/#resolved-cve-2026-89325","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-96747","sourceIdentifier":"cna@mongodb.com","published":"2026-09-24T19:17:20.650","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in \".sock\" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB","product":"Python Driver","defaultStatus":"unaffected","versions":[{"version":"3.9.0","lessThan":"4.18.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:36:00.653378Z","id":"CVE-2026-96747","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8mw2-4r3x","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-96748","sourceIdentifier":"cna@mongodb.com","published":"2026-09-24T19:17:20.813","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB","product":"Python Driver","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.18.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:36:30.450714Z","id":"CVE-2026-96748","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-177"}]}],"references":[{"url":"https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-96749","sourceIdentifier":"cna@mongodb.com","published":"2026-09-24T19:17:20.963","lastModified":"2026-09-26T04:17:52.260","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer inside the application's own process."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB","product":"Python Driver","defaultStatus":"unaffected","versions":[{"version":"1.9.0","lessThan":"4.18.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T00:00:00+00:00","id":"CVE-2026-96749","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-97320","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T19:17:21.247","lastModified":"2026-09-25T15:17:57.377","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"YunaiV","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["AI Knowledge Module"],"versions":[{"version":"2026.08","status":"affected"}]},{"vendor":"zhijiantianya","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["AI Knowledge Module"],"versions":[{"version":"2026.08","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T14:05:03.509294Z","id":"CVE-2026-97320","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97320","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908270","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409328","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409328/cti","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908270","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97321","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T19:17:21.430","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoView Data Endpoint. Such manipulation of the argument sql leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"YunaiV","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["GoView Data Endpoint"],"versions":[{"version":"2026.08","status":"affected"}]},{"vendor":"zhijiantianya","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["GoView Data Endpoint"],"versions":[{"version":"2026.08","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:50:44.044955Z","id":"CVE-2026-97321","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97321","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908272","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409329","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409329/cti","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908272","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97322","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T19:17:21.637","lastModified":"2026-09-29T04:18:02.747","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"YunaiV","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["File Upload"],"versions":[{"version":"2026.08","status":"affected"}]},{"vendor":"zhijiantianya","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["File Upload"],"versions":[{"version":"2026.08","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:09:38.965416Z","id":"CVE-2026-97322","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97322","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908273","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409330","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409330/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97323","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T19:17:21.820","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java of the component File Upload. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"YunaiV","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["File Upload"],"versions":[{"version":"2026.08","status":"affected"}]},{"vendor":"zhijiantianya","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["File Upload"],"versions":[{"version":"2026.08","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:24:30.726394Z","id":"CVE-2026-97323","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97323","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908274","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409331","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409331/cti","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908274","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-48540","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T20:17:29.117","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected lead record."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"krayin","product":"laravel-crm","defaultStatus":"unknown","repo":"https://github.com/krayin/laravel-crm","packageURL":"pkg:github/krayin/laravel-crm","versions":[{"version":"0","lessThanOrEqual":"2.2.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:35:00.774527Z","id":"CVE-2026-48540","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48540","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-lead-title","source":"disclosure@vulncheck.com"},{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48540","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-48541","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T20:17:29.287","lastModified":"2026-09-30T18:18:37.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected person record."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"krayin","product":"laravel-crm","defaultStatus":"unknown","repo":"https://github.com/krayin/laravel-crm","packageURL":"pkg:github/krayin/laravel-crm","versions":[{"version":"0","lessThanOrEqual":"2.2.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:43:46.646473Z","id":"CVE-2026-48541","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-contact-name-field","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-48542","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T20:17:29.433","lastModified":"2026-09-29T04:17:56.023","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attackers can craft a product name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected product record."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"krayin","product":"laravel-crm","defaultStatus":"unknown","repo":"https://github.com/krayin/laravel-crm","packageURL":"pkg:github/krayin/laravel-crm","versions":[{"version":"0","lessThanOrEqual":"2.2.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:10:16.233438Z","id":"CVE-2026-48542","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-product-name-field","source":"disclosure@vulncheck.com"},{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-48543","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T20:17:29.573","lastModified":"2026-09-25T18:17:25.943","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form description containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected web form."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"krayin","product":"laravel-crm","defaultStatus":"unknown","repo":"https://github.com/krayin/laravel-crm","packageURL":"pkg:github/krayin/laravel-crm","versions":[{"version":"0","lessThanOrEqual":"2.2.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:13:09.686517Z","id":"CVE-2026-48543","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-web-form-description","source":"disclosure@vulncheck.com"},{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-77967","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:30.227","lastModified":"2026-09-25T17:17:14.407","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another client to establish an authenticated session and access privileged device functionality."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:29:34.558371Z","id":"CVE-2026-77967","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-294"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-82164","sourceIdentifier":"security_alert@emc.com","published":"2026-09-24T20:17:32.103","lastModified":"2026-09-26T04:17:47.720","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Trusted Device Client,","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8.1.359.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T00:00:00+00:00","id":"CVE-2026-82164","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000506918/dsa-2026-408-security-update-for-dell-trusted-device-client-for-an-incorrect-permission-assignment-for-critical-resource-vulnerability","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-82372","sourceIdentifier":"sirt@brocade.com","published":"2026-09-24T20:17:32.353","lastModified":"2026-10-01T21:17:25.900","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the potential exposure of keys used to secure network tunnels."}],"affected":[{"source":"sirt@brocade.com","affectedData":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.0.1","versionType":"Brocade SANnav","status":"affected","changes":[{"at":"3.0.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"sirt@brocade.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:25:24.827937Z","id":"CVE-2026-82372","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sirt@brocade.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38997","source":"sirt@brocade.com"}]}},{"cve":{"id":"CVE-2026-82566","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:32.503","lastModified":"2026-09-24T21:25:27.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated or replaced. Under certain connection conditions, a newly established connection can displace an existing client while previously established session state remains active until a separate expiration mechanism invalidates it. An unauthenticated attacker with adjacent network access could potentially take advantage of this residual authentication state to access functionality associated with another client's session."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:36:51.806985Z","id":"CVE-2026-82566","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Primary","description":[{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-84399","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:32.673","lastModified":"2026-09-24T21:25:27.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession of a valid session identifier without adequately validating the requesting client's authenticated context. An unauthenticated attacker with adjacent network access could potentially use valid session state associated with another client to access privileged functionality."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:35:40.766701Z","id":"CVE-2026-84399","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-85496","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:32.890","lastModified":"2026-09-25T17:17:16.417","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably unpredictable source. An unauthenticated attacker with adjacent network access and knowledge that an active session exists could potentially determine a valid session identifier and use it to bypass intended authorization controls."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:30:11.994628Z","id":"CVE-2026-85496","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-340"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-88761","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:33.643","lastModified":"2026-09-25T17:17:18.277","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware generates the default WiFi password using predictable device information, portions of which are advertised by the product. An unauthenticated attacker within WiFi range could potentially determine the remaining password characters through limited guessing and gain unauthorized access to the device network."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:28:53.763452Z","id":"CVE-2026-88761","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-1391"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-88956","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:33.793","lastModified":"2026-09-25T17:17:18.660","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the interface also displays the device's WiFi password during startup. An unauthenticated attacker with physical access to the device could connect to the UART interface, obtain root privileges, and recover the WiFi password."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"PHYSICAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:33:35.486957Z","id":"CVE-2026-88956","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-93289","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:34.137","lastModified":"2026-09-24T21:25:27.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Eufy","product":"Omni C20","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.6.4","versionType":"custom","status":"affected"}]},{"vendor":"Eufy","product":"Omni X10 Pro","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.6.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"ADJACENT","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:36:22.263773Z","id":"CVE-2026-93289","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-02","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-93290","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:34.307","lastModified":"2026-09-24T21:25:27.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapping data."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Eufy","product":"Omni C20","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.6.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:35:59.205461Z","id":"CVE-2026-93290","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Primary","description":[{"lang":"en","value":"CWE-798"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-02","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-93291","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:34.463","lastModified":"2026-09-24T21:25:27.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Eufy","product":"Omni C20","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.6.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:33:25.114444Z","id":"CVE-2026-93291","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Primary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-02","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-93354","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T20:17:34.613","lastModified":"2026-10-05T21:16:38.037","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no authentication. Attackers can send a POST request to the registration endpoint to obtain a client_id and client_secret, then craft a malicious authorization link pointing to an attacker-controlled redirect URI to capture authorization codes and exchange them for access tokens granting full API access to victim account data."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Gimanh","product":"taskview-community","defaultStatus":"unaffected","repo":"https://github.com/Gimanh/taskview-community","packageURL":"pkg:github/Gimanh/taskview-community","versions":[{"version":"0","lessThan":"1.56.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:42:33.450779Z","id":"CVE-2026-93354","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1188"}]}],"references":[{"url":"https://github.com/Gimanh/taskview-community/releases/tag/v1.56.0","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/taskview-community-missing-authentication-via-oauth-dynamic-client-registration","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-96883","sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","published":"2026-09-24T20:17:35.240","lastModified":"2026-09-25T13:16:34.693","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in collection value retrieval and array conversion functions.\n\n\n\nTo remediate this issue, users should upgrade to version 2.1.2 or later."}],"affected":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","affectedData":[{"vendor":"AWS","product":"pgcollection","defaultStatus":"unaffected","versions":[{"version":"2.0.0","lessThanOrEqual":"2.1.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:26:07.145601Z","id":"CVE-2026-96883","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-118-aws/","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/aws/pgcollection/releases/tag/v2.1.2","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/aws/pgcollection/security/advisories/GHSA-g539-cj32-hv6r","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}]}},{"cve":{"id":"CVE-2026-97324","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T20:17:35.553","lastModified":"2026-10-05T16:17:18.320","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback Handler. The manipulation of the argument ID leads to improper authorization. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"YunaiV","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["Demo-order Payment Callback Handler"],"versions":[{"version":"2026.08","status":"affected"}]},{"vendor":"zhijiantianya","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["Demo-order Payment Callback Handler"],"versions":[{"version":"2026.08","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:04:26.173686Z","id":"CVE-2026-97324","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97324","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908275","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409332","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409332/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97325","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T20:17:35.730","lastModified":"2026-09-25T15:17:57.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability is the function validOAuthClientFromCache of the file yudao-module-system/src/main/java/cn/iocoder/yudao/module/system/service/oauth2/OAuth2ClientServiceImpl.java of the component OAuth2 Client. The manipulation of the argument redirect_uri results in open redirect. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"YunaiV","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["OAuth2 Client"],"versions":[{"version":"2026.08","status":"affected"}]},{"vendor":"zhijiantianya","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["OAuth2 Client"],"versions":[{"version":"2026.08","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T14:03:39.880509Z","id":"CVE-2026-97325","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97325","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908276","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409333","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409333/cti","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908276","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97326","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T20:17:35.907","lastModified":"2026-09-25T18:17:34.380","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java of the component chat-server. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"songxinjianqwe","product":"Chat","cpes":["cpe:2.3:a:songxinjianqwe:chat:*:*:*:*:*:*:*:*"],"modules":["chat-server"],"versions":[{"version":"ac63d25297079eed5e4ba7e88d3b7a032637150d","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:02:57.611391Z","id":"CVE-2026-97326","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/HazyX0/cve/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97326","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908781","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409334","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409334/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97365","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T20:17:36.093","lastModified":"2026-09-29T04:18:02.903","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file crates/littrs/src/lib.rs. Executing a manipulation of the argument relative can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"chonkie-inc","product":"littrs","cpes":["cpe:2.3:a:chonkie-inc:littrs:*:*:*:*:*:*:*:*"],"versions":[{"version":"0.6.1","status":"affected"},{"version":"0.6.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:11:14.209798Z","id":"CVE-2026-97365","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/chonkie-inc/littrs/","source":"cna@vuldb.com"},{"url":"https://github.com/chonkie-inc/littrs/security/advisories/GHSA-j65r-rjxh-fgc4","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97365","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/909328","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409349","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409349/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-14441","sourceIdentifier":"sirt@brocade.com","published":"2026-09-24T21:17:10.670","lastModified":"2026-10-01T21:17:19.540","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and prevent potential identity mismatch conditions."}],"affected":[{"source":"sirt@brocade.com","affectedData":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.1.0a","versionType":"Brocade SANnav","status":"affected","changes":[{"at":"3.1.0a","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"sirt@brocade.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:56:52.119011Z","id":"CVE-2026-14441","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sirt@brocade.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1025"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39000","source":"sirt@brocade.com"}]}},{"cve":{"id":"CVE-2026-14442","sourceIdentifier":"sirt@brocade.com","published":"2026-09-24T21:17:11.920","lastModified":"2026-10-01T21:17:19.673","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. When scheduled support save jobs or related operational tasks are executed, sensitive parameters including external server passwords and archive protection keys are logged without proper masking. A local or authenticated user with access to application logs or support bundles can view these cleartext credentials, potentially leading to unauthorized access to remote backup targets or protected archives."}],"affected":[{"source":"sirt@brocade.com","affectedData":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.1.0a","versionType":"Brocade SANnav","status":"affected","changes":[{"at":"3.1.0a","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"sirt@brocade.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T21:04:53.874700Z","id":"CVE-2026-14442","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sirt@brocade.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38999","source":"sirt@brocade.com"}]}},{"cve":{"id":"CVE-2026-14443","sourceIdentifier":"sirt@brocade.com","published":"2026-09-24T21:17:12.130","lastModified":"2026-10-01T21:17:19.800","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written to system logs. Individuals with read access to container logs or support archives can obtain these keys, leading to the potential compromise of encrypted network tunnels."}],"affected":[{"source":"sirt@brocade.com","affectedData":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.0.1.a","versionType":"Brocade SANnav","status":"affected","changes":[{"at":"before 3.0.1.a","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"sirt@brocade.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:27:24.937174Z","id":"CVE-2026-14443","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sirt@brocade.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38998","source":"sirt@brocade.com"}]}},{"cve":{"id":"CVE-2026-75558","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:36.203","lastModified":"2026-09-25T17:17:14.277","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who obtains the protected credential and extracts the cryptographic material from the firmware could recover the WiFi password and gain unauthorized access to the device network."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:23:54.317735Z","id":"CVE-2026-75558","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-79959","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:44.353","lastModified":"2026-09-25T17:17:14.720","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. An attacker who obtains the firmware or has physical access to the device could recover the credential and use it to obtain root access through the UART interface."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"PHYSICAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:19:50.495303Z","id":"CVE-2026-79959","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-798"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-81630","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:48.737","lastModified":"2026-09-25T17:17:15.007","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmware through an unprotected connection and relies on an integrity value supplied with the firmware instead of a trusted cryptographic signature. A suitably positioned attacker who intercepts a firmware download, or an authenticated attacker who submits a crafted update, could install modified firmware and execute unauthorized code on the device."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:22:58.800724Z","id":"CVE-2026-81630","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-82585","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:50.167","lastModified":"2026-09-25T17:17:15.133","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of intercepting communications on the device's WiFi network could obtain stored recordings, live video, location information, images, diagnostic logs, or other sensitive information exchanged between the device and its mobile application."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:18:25.762931Z","id":"CVE-2026-82585","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-319"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-82708","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:50.330","lastModified":"2026-09-25T17:17:15.267","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server. An attacker with access to the device's WiFi network could submit a crafted request to access files within the device's removable storage that were not intended to be directly accessible through the web server. Exposed files could include recordings, images, diagnostic logs, or firmware files."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:21:06.946401Z","id":"CVE-2026-82708","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-82716","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:50.483","lastModified":"2026-09-25T17:17:15.393","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware includes sensitive configuration information, including WiFi credentials, in diagnostic logs generated during the support process. These logs remain accessible on removable storage after the support operation has completed. An unauthenticated attacker with physical access to the storage media could retrieve the logs and obtain sensitive device information."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:28:13.355260Z","id":"CVE-2026-82716","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-84403","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:55.220","lastModified":"2026-09-25T17:17:15.643","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device information, including device identifiers, firmware information, and protected WiFi credentials."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:24:46.709740Z","id":"CVE-2026-84403","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-87118","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:56.603","lastModified":"2026-09-25T17:17:16.550","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functionality. An authenticated attacker with adjacent network access could submit crafted command data that corrupts memory, potentially disrupting authentication state or causing the affected process to terminate and the device to restart, resulting in a temporary denial of service."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:21:54.027592Z","id":"CVE-2026-87118","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-88386","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T21:18:57.003","lastModified":"2026-09-25T17:17:17.833","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int * and perform a 4-byte store. This results in undefined behavior leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:48:59.681171Z","id":"CVE-2026-88386","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://github.com/libsndfile/libsndfile/issues/1150","source":"cve@mitre.org"},{"url":"https://github.com/mhlavink/libsndfileci/commit/474e4d328b1e6240b93ec6ed14efb7c6a44bee57","source":"cve@mitre.org"},{"url":"https://github.com/libsndfile/libsndfile/issues/1150","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88387","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T21:18:57.120","lastModified":"2026-09-29T03:17:21.263","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts this value and narrows it to int without performing range validation. This out-of-range conversion triggers undefined behavior, resulting in process termination and denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:38:06.086578Z","id":"CVE-2026-88387","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-681"}]}],"references":[{"url":"https://github.com/LibRaw/LibRaw/commit/b41cbbd61951783e0440590dae55411a16185bdf","source":"cve@mitre.org"},{"url":"https://github.com/LibRaw/LibRaw/issues/844","source":"cve@mitre.org"},{"url":"https://github.com/LibRaw/LibRaw/pull/853","source":"cve@mitre.org"},{"url":"https://github.com/LibRaw/LibRaw/issues/844","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88388","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T21:18:57.247","lastModified":"2026-09-25T16:17:29.213","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. A remote attacker can supply JavaScript input that triggers an exception and reaches jslPrintTokenLineMarker(), which passes the address of a 4-byte int column variable to jsvGetLineAndCol() as a size_t pointer. jsvGetLineAndCol() performs an 8-byte write through the mismatched pointer, overwriting adjacent stack memory."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:14:04.581717Z","id":"CVE-2026-88388","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://github.com/espruino/Espruino/commit/ecd7d43e084ba9aafa8245609347fe0f4383b38c","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-93353","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T21:18:58.310","lastModified":"2026-09-30T21:17:17.490","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers to traverse symlinks leaving a volume's top directory and perform unauthorized file creation, deletion, or truncation via SSH_FXP_SETSTAT operations on paths outside any volume the account is authorized to access."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"9001","product":"copyparty","defaultStatus":"unknown","collectionURL":"https://pypi.org/project/copyparty/","repo":"https://github.com/9001/copyparty","packageURL":"pkg:github/9001/copyparty","versions":[{"version":"0","lessThanOrEqual":"1.20.24","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:50:59.870381Z","id":"CVE-2026-93353","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"},{"lang":"en","value":"CWE-424"}]}],"references":[{"url":"https://euriconicacio.github.io/blog/cve-2026-93353-a-volume-guard-enforced-one-call-site-at-a-time/","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/copyparty-sftp-volume-restriction-bypass-via-mkdir-rmdir-chattr-handlers","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-95699","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:58.613","lastModified":"2026-09-25T17:17:20.097","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"MrSteam","product":"iSteamX application","defaultStatus":"unaffected","versions":[{"version":"v1.3.42 (build 44)","status":"affected"}]},{"vendor":"MrSteam","product":"iSteamX Hub","defaultStatus":"unaffected","versions":[{"version":"v4.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:16:01.270470Z","id":"CVE-2026-95699","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-653"}]}],"references":[{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.mrsteam.com/contactus/","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-97366","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T21:18:58.777","lastModified":"2026-09-25T16:17:30.567","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"jhen0409","product":"react-native-debugger","cpes":["cpe:2.3:a:jhen0409:react-native-debugger:*:*:*:*:*:*:*:*"],"modules":["Open in Editor Handler"],"versions":[{"version":"0.1","status":"affected"},{"version":"0.2","status":"affected"},{"version":"0.3","status":"affected"},{"version":"0.4","status":"affected"},{"version":"0.5","status":"affected"},{"version":"0.6","status":"affected"},{"version":"0.7","status":"affected"},{"version":"0.8","status":"affected"},{"version":"0.9","status":"affected"},{"version":"0.10","status":"affected"},{"version":"0.11","status":"affected"},{"version":"0.12","status":"affected"},{"version":"0.13","status":"affected"},{"version":"0.14.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:53:00.869447Z","id":"CVE-2026-97366","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://gist.github.com/Suuuuuzy/d25baf1973fd3c812277e02cde2243cc","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97366","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/909329","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409351","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409351/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97368","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T21:18:58.953","lastModified":"2026-09-25T14:17:25.733","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of the argument userId causes authorization bypass. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. CVE-2026-56100 and CVE-2026-36765 are distinct issues. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"chillzhuang","product":"SpringBlade","cpes":["cpe:2.3:a:chillzhuang:springblade:*:*:*:*:*:*:*:*"],"modules":["user-auth-info Endpoint"],"versions":[{"version":"5.0.0","status":"affected"},{"version":"5.0.1","status":"affected"},{"version":"5.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T14:00:44.095762Z","id":"CVE-2026-97368","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://aibot88.github.io/CVERequest/SpringBlade/issue2.html","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97368","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/909894","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409352","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409352/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-85491","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-09-24T22:17:02.027","lastModified":"2026-09-25T17:17:16.240","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone.\n\nCatalyst::Seal replaces the dispatcher's prepare_action with a version that memoises how a path resolved: which dispatch type matched, at which level, and what was left over as arguments. The key is the request path and nothing else. Action roles that match on the method, content type, scheme or query make that resolution depend on state the key does not carry, so the memo answers for a request it was not built from.\n\nA path that resolves to no action is memoised as well, and replaying that entry returns without consulting any dispatch type, so no action is set and the request fails. A GET of a path whose action is declared POST-only therefore disables that path for every later request, the correct POST included. An entry that did resolve replays the level the earlier descent reached. Where a POST-only action sits below a shallower action on the same path, a GET memoises the shallow route, and a later POST is dispatched there with an auto() guarding the deeper controller never running.\n\nThe memo is cleared only when an action is registered, which happens at setup, so an entry lasts for the life of the process, and its cap of 2048 entries bounds how many paths one caller can disable. In the configuration measured, the misroute lands on the less privileged action, so it is an authorization check not running rather than a privilege gain."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"Catalyst-Seal","modules":["Catalyst::Seal"],"programFiles":["lib/Catalyst/Seal/Dispatch.pm"],"programRoutines":[{"name":"Catalyst::Seal::Dispatch::_prepare_action"}],"packageURL":"pkg:cpan/Catalyst-Seal","versions":[{"version":"0","lessThan":"0.03","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:34:58.812834Z","id":"CVE-2026-85491","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-706"},{"lang":"en","value":"CWE-1023"}]}],"references":[{"url":"https://metacpan.org/release/LNATION/Catalyst-Seal-0.02/source/lib/Catalyst/Seal/Dispatch.pm#L237-280","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/LNATION/Catalyst-Seal-0.03/changes","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/8","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/9","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-87720","sourceIdentifier":"cve-coordination@google.com","published":"2026-09-24T22:17:02.170","lastModified":"2026-09-25T17:17:16.687","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user (or an unauthenticated user if the repository was previously public) to cause unauthorized disclosure of private repository content and durable restoration of revoked project-owner administrative privileges via crafted requests using repeated .git suffixes (such as project.git.git) across REST APIs, Gitiles, or SSH Git commands. Because Gerrit strips only a single terminal .git suffix when constructing the logical ProjectCache key while JGit (FileKey.lenient) resolves the suffixed alias to the same canonical bare repository on disk, revoking read access or removing owner rules on the canonical project name fails to evict the cached alias ProjectState during the cache validity window, enabling reads of newly created private commits or writes to refs/meta/config. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3."}],"affected":[{"source":"cve-coordination@google.com","affectedData":[{"vendor":"Gerrit","product":"Gerrit","defaultStatus":"unaffected","versions":[{"version":"2.16.0","lessThan":"3.12.10","versionType":"semver","status":"affected"},{"version":"3.13.0","lessThan":"3.13.9","versionType":"semver","status":"affected"},{"version":"3.14.0","lessThan":"3.14.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@google.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:51:27.457102Z","id":"CVE-2026-87720","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"},{"lang":"en","value":"CWE-706"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://issues.gerritcodereview.com/issues/538883789","source":"cve-coordination@google.com"},{"url":"https://issues.gerritcodereview.com/issues/538883789","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-87721","sourceIdentifier":"cve-coordination@google.com","published":"2026-09-24T22:17:02.327","lastModified":"2026-09-25T17:17:17.107","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a persistent denial of service (CPU exhaustion and HTTP worker thread pool starvation requiring a server restart) via crafted search queries containing deeply nested parentheses sent to query evaluation endpoints (/changes/?q=, /accounts/?q=, /groups/?query=, /projects/?query=, /Documentation/?q=, /changes/{id}/query?expression=, or SSH gerrit query). Because syntactic predicates in conditionOr and conditionAnd recurse via conditionBase without memoization prior to capability or visibility checks and worker threads do not abort when the client disconnects, a small number of requests (such as 25 requests matching default httpd.maxThreads) can permanently pin all HTTP worker threads. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3."}],"affected":[{"source":"cve-coordination@google.com","affectedData":[{"vendor":"Gerrit","product":"Gerrit","defaultStatus":"unaffected","versions":[{"version":"2.0.19","lessThan":"3.12.10","versionType":"semver","status":"affected"},{"version":"3.13.0","lessThan":"3.13.9","versionType":"semver","status":"affected"},{"version":"3.14.0","lessThan":"3.14.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@google.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:45:47.938400Z","id":"CVE-2026-87721","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-407"},{"lang":"en","value":"CWE-834"}]}],"references":[{"url":"https://issues.gerritcodereview.com/issues/541287630","source":"cve-coordination@google.com"}]}},{"cve":{"id":"CVE-2026-87722","sourceIdentifier":"cve-coordination@google.com","published":"2026-09-24T22:17:02.480","lastModified":"2026-09-25T17:17:17.360","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate, and sibling predicates) and REST regex filter endpoints (RegexListSearcher /projects/?r= and RefFilter /projects/{project}/branches/?r=) in Gerrit Code Review versions 2.1.6 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a denial of service (CPU starvation and JVM heap exhaustion / OutOfMemoryError) via crafted search queries or REST API requests containing regular expressions with large counted repetitions or exponential DFA determinization patterns. Because the user-supplied regular expression is compiled into an unbounded dk.brics.automaton instance (new RegExp(re).toAutomaton()) on the request thread prior to index evaluation or access control visibility filtering, trivial queries can exhaust JVM heap or pin request threads regardless of heap size. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3."}],"affected":[{"source":"cve-coordination@google.com","affectedData":[{"vendor":"Gerrit","product":"Gerrit","defaultStatus":"unaffected","versions":[{"version":"2.1.6","lessThan":"3.12.10","versionType":"semver","status":"affected"},{"version":"3.13.0","lessThan":"3.13.9","versionType":"semver","status":"affected"},{"version":"3.14.0","lessThan":"3.14.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@google.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:40:30.387337Z","id":"CVE-2026-87722","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://issues.gerritcodereview.com/issues/540877705","source":"cve-coordination@google.com"}]}},{"cve":{"id":"CVE-2026-97636","sourceIdentifier":"security@apache.org","published":"2026-09-24T22:17:02.660","lastModified":"2026-09-25T17:17:21.137","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to a different team, because after the team-scoped lookup misses the backend falls back to a team-agnostic path concatenated from the unvalidated key. The Execution API Variables route accepts a path-shaped key, so this is reachable from ordinary Dag code.\n\nAffects multi-team deployments using the HashiCorp Vault secrets backend. Single-team deployments are not affected, as there is no cross-team boundary to cross. This is the same class as CVE-2026-86465, CVE-2026-68870, CVE-2026-68871 and CVE-2026-68872 in the Akeyless, Azure Key Vault, Yandex Lockbox and Amazon secrets backends.\n\nUsers of apache-airflow-providers-hashicorp are recommended to upgrade to version 4.8.0 or later, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Airflow HashiCorp provider","defaultStatus":"unaffected","collectionURL":"https://pypi.python.org","packageName":"apache-airflow-providers-hashicorp","packageURL":"pkg:pypi/apache-airflow-providers-hashicorp","versions":[{"version":"4.6.0","lessThan":"4.8.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:37:39.918441Z","id":"CVE-2026-97636","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/apache/airflow/pull/70006","source":"security@apache.org"},{"url":"https://lists.apache.org/thread/l0fogo9dh5v07vnsxnhoh3c74othkr51","source":"security@apache.org"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68870","source":"security@apache.org"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68871","source":"security@apache.org"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68872","source":"security@apache.org"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86465","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-97230","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-09-24T23:19:22.960","lastModified":"2026-09-25T17:17:20.880","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL.\n\nThe generate_certificate runs a Python script saved as a certificate file.  The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly.\n\nThe impact is that arbitrary code can be invoked as the user, without a dropped script being saved on the affected host.\n\nThe releases have no test scripts nor build hooks.  The intention may have been to trigger the payload after installation.\n\nThe dropper script is in lib/Crypt/SelfCertificate/sample/cert.pem.\n\nThis is similar to CVE-2026-95831 for the module Crypt::SelfCertificate.\n\nThe SHA-256 digests of the files are\n\n    ba24ee8ec3b7f47f65bed62e16fb413ace50653cf44bd8ea90914390922831e0  IO-Socket-SSL-SelfCertificate-1.00.tar.gz\n    821d38830e5eb8607738421c25ac25f59fff02a6ab67daa32fbd020429454dac  IO-Socket-SSL-SelfCertificate-1.00/lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem\n\n    d483cb7b23b7271cb11cf242bff4a2e1c02df0b9525eb0429abeea8961c399d5  IO-Socket-SSL-SelfCertificate-1.00-upload.tar.gz"}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"IO-Socket-SSL-SelfCertificate","modules":["IO::Socket::SSL::SelfCertificate"],"programFiles":["lib/IO/Socket/SSL/SelfCertificate.pm","lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem"],"packageURL":"pkg:cpan/IO-Socket-SSL-SelfCertificate","versions":[{"version":"1.00","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:11:04.730543Z","id":"CVE-2026-97230","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-506"}]}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-95831","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://www.nntp.perl.org/group/perl.cpan.testers.discuss/2026/09/msg4756.html","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}]}},{"cve":{"id":"CVE-2026-97387","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T23:19:23.077","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE is a duplicate of another CVE."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-84283","sourceIdentifier":"help@fluidattacks.com","published":"2026-09-25T00:16:57.570","lastModified":"2026-09-25T17:17:15.520","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Folder."}],"affected":[{"source":"help@fluidattacks.com","affectedData":[{"vendor":"FluteCode","product":"Secure Folder","defaultStatus":"unaffected","platforms":["Android"],"versions":[{"version":"1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"help@fluidattacks.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:03:38.587820Z","id":"CVE-2026-84283","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"help@fluidattacks.com","type":"Secondary","description":[{"lang":"en","value":"CWE-922"}]}],"references":[{"url":"https://fluidattacks.com/advisories/sanguisugabogg","source":"help@fluidattacks.com"},{"url":"https://play.google.com/store/apps/details?id=com.securefolder.securevault","source":"help@fluidattacks.com"}]}},{"cve":{"id":"CVE-2026-85082","sourceIdentifier":"help@fluidattacks.com","published":"2026-09-25T00:16:57.720","lastModified":"2026-09-25T17:17:15.800","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command."}],"affected":[{"source":"help@fluidattacks.com","affectedData":[{"vendor":"Maple Media","product":"Root Browser Classic","defaultStatus":"unaffected","platforms":["Android"],"versions":[{"version":"3.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"help@fluidattacks.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:01:58.076353Z","id":"CVE-2026-85082","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"help@fluidattacks.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://fluidattacks.com/advisories/infant","source":"help@fluidattacks.com"},{"url":"https://play.google.com/store/apps/details?id=com.jrummyapps.rootbrowser.classic","source":"help@fluidattacks.com"},{"url":"https://fluidattacks.com/advisories/infant","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-53493","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T01:16:48.227","lastModified":"2026-09-28T15:17:17.900","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"containerd","product":"containerd","versions":[{"version":">= 2.0.0, < 2.0.13","status":"affected"},{"version":"< 1.7.36","status":"affected"},{"version":">= 2.1.0, < 2.2.9","status":"affected"},{"version":">= 2.3.0, < 2.3.6","status":"affected"},{"version":"= 2.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:58:24.201213Z","id":"CVE-2026-53493","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"},{"lang":"en","value":"CWE-834"}]}],"references":[{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-85417","sourceIdentifier":"sirt@brocade.com","published":"2026-09-25T01:16:48.580","lastModified":"2026-09-29T19:17:27.183","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete property masking in the SANnav logging subsystem permits SNMP authentication and privacy passwords to be recorded in application logs under specific configuration conditions. Individuals with read access to system logs or support bundles can retrieve these credentials, leading to unauthorized read or management access to monitored switch environments"}],"affected":[{"source":"sirt@brocade.com","affectedData":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.1.0a","versionType":"Brocade SANnac","status":"affected","changes":[{"at":"3.1.0a","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"sirt@brocade.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:48:54.201840Z","id":"CVE-2026-85417","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sirt@brocade.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39001","source":"sirt@brocade.com"}]}},{"cve":{"id":"CVE-2026-92288","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-09-25T01:16:48.820","lastModified":"2026-09-25T16:17:29.543","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party.\n\ncheckEndPointAuthenticationCredentials() skips the secret comparison for a Relying Party marked public and still returns the authentication method deduced from the request, client_secret_basic or client_secret_post. introspection() rejects a caller only when that method is missing or none, so a request carrying a public client_id and an arbitrary or empty secret passes the endpoint's authentication check.\n\nAn attacker who holds an access token and knows the client_id of any public Relying Party can confirm the token is active and read its metadata, including scope, audience, expiry and the sub claim. The sub claim is computed with the calling Relying Party's user identifier attribute, so an attacker can translate a user identifier from one Relying Party to another, defeating per-client and pseudonymous identifiers."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"Lemonldap-NG-Portal","modules":["Lemonldap::NG::Portal"],"programFiles":["lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm","lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm"],"programRoutines":[{"name":"Lemonldap::NG::Portal::Lib::OpenIDConnect::checkEndPointAuthenticationCredentials"},{"name":"Lemonldap::NG::Portal::Issuer::OpenIDConnect::introspection"}],"repo":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng","packageURL":"pkg:cpan/Lemonldap-NG-Portal","versions":[{"version":"2.20.0","lessThan":"2.21.6","versionType":"custom","status":"affected"},{"version":"2.22.0","lessThan":"2.23.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:47:19.676630Z","id":"CVE-2026-92288","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-1390"}]}],"references":[{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.21.6","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.23.4","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3719","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3721","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/25/1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3719","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-92289","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-09-25T01:16:48.943","lastModified":"2026-09-26T23:16:38.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in \"PKCE or secret\" mode because checkEndPointAuthenticationCredentials does not verify the client secret.\n\nWith oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint issues a code even when the request carries no code_challenge, and token() admits the exchange as long as a challenge was stored or an authentication method was returned for the caller. checkEndPointAuthenticationCredentials() skips the secret comparison for a Relying Party marked public and still returns the method deduced from the request, so any Basic or form credential satisfies the secret branch. validatePKCEChallenge() then passes, because neither a challenge nor a verifier is present.\n\nAn attacker who intercepts an authorization code issued to a public Relying Party can exchange it for the user's access, ID and refresh tokens by replaying the client_id with an arbitrary secret, which is the attack PKCE prevents. Dynamic client registration creates every Relying Party in this mode."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"Lemonldap-NG-Portal","modules":["Lemonldap::NG::Portal"],"programFiles":["lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm","lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm"],"programRoutines":[{"name":"Lemonldap::NG::Portal::Lib::OpenIDConnect::checkEndPointAuthenticationCredentials"},{"name":"Lemonldap::NG::Portal::Issuer::OpenIDConnect::token"}],"repo":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng","packageURL":"pkg:cpan/Lemonldap-NG-Portal","versions":[{"version":"2.23.0","lessThan":"2.23.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:38:54.575555Z","id":"CVE-2026-92289","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-1390"}]}],"references":[{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.23.4","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3719","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/25/2","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3719","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97646","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T01:16:49.063","lastModified":"2026-09-25T16:17:30.850","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This affects an unknown function of the file admin/fun/getStudent.php. This manipulation of the argument sid causes authorization bypass. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"ningzichun","product":"student-management-system","cpes":["cpe:2.3:a:ningzichun:student-management-system:*:*:*:*:*:*:*:*"],"versions":[{"version":"98760f5711cf6dc8b4adca53a9e207ca49b02ebf","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:42:42.847944Z","id":"CVE-2026-97646","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/ningzichun/student-management-system/","source":"cna@vuldb.com"},{"url":"https://github.com/ningzichun/student-management-system/issues/9","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97646","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/910054","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409748","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409748/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95811","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-09-25T02:16:54.677","lastModified":"2026-09-26T16:16:39.087","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it.\n\nThe handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike.\n\nOnly a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"Lemonldap-NG-Handler","modules":["Lemonldap::NG::Handler"],"programFiles":["lib/Lemonldap/NG/Handler/Main/Run.pm"],"programRoutines":[{"name":"Lemonldap::NG::Handler::Main::Run::run"},{"name":"Lemonldap::NG::Handler::Main::Run::grant"},{"name":"Lemonldap::NG::Handler::Main::Run::getLevel"},{"name":"Lemonldap::NG::Handler::Main::Run::isUnprotected"}],"repo":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng","packageURL":"pkg:cpan/Lemonldap-NG-Handler","versions":[{"version":"2.0.0","lessThan":"2.16.10","versionType":"custom","status":"affected"},{"version":"2.17.0","lessThan":"2.21.6","versionType":"custom","status":"affected"},{"version":"2.22.0","lessThan":"2.23.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:53:01.823535Z","id":"CVE-2026-95811","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-180"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3723","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.16.10","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.21.6","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.23.4","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-24660","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://lists.debian.org/debian-lts-announce/2026/09/msg00032.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3723","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97647","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T02:16:54.817","lastModified":"2026-09-29T04:18:03.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown function of the file user/editLog.php. Such manipulation of the argument sid/addtime/type/reason/detail/logdate leads to authorization bypass. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"ningzichun","product":"student-management-system","cpes":["cpe:2.3:a:ningzichun:student-management-system:*:*:*:*:*:*:*:*"],"versions":[{"version":"98760f5711cf6dc8b4adca53a9e207ca49b02ebf","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:22:34.688106Z","id":"CVE-2026-97647","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/ningzichun/student-management-system/","source":"cna@vuldb.com"},{"url":"https://github.com/ningzichun/student-management-system/issues/10","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97647","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/910056","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409749","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409749/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97648","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T02:16:55.000","lastModified":"2026-09-25T16:17:30.993","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function. Performing a manipulation results in cross-site request forgery. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"ningzichun","product":"student-management-system","cpes":["cpe:2.3:a:ningzichun:student-management-system:*:*:*:*:*:*:*:*"],"versions":[{"version":"98760f5711cf6dc8b4adca53a9e207ca49b02ebf","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:24:34.353015Z","id":"CVE-2026-97648","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/ningzichun/student-management-system/","source":"cna@vuldb.com"},{"url":"https://github.com/ningzichun/student-management-system/issues/12","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97648","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/910057","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409750","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409750/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97649","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T02:16:55.183","lastModified":"2026-09-25T15:18:01.647","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is an unknown functionality of the file example_lite.sql. Executing a manipulation can lead to use of default credentials. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"ningzichun","product":"student-management-system","cpes":["cpe:2.3:a:ningzichun:student-management-system:*:*:*:*:*:*:*:*"],"versions":[{"version":"98760f5711cf6dc8b4adca53a9e207ca49b02ebf","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T14:06:18.197925Z","id":"CVE-2026-97649","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1392"}]}],"references":[{"url":"https://github.com/ningzichun/student-management-system/","source":"cna@vuldb.com"},{"url":"https://github.com/ningzichun/student-management-system/issues/13","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97649","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/910058","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409751","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409751/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97723","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T02:16:55.377","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated href attribute and introduce attacker-controlled HTML attributes, allowing arbitrary JavaScript to execute in the browser of another user when the stored chat message was rendered. No click on the malicious link was required."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"madpsy","product":"ka9q_ubersdr","defaultStatus":"unaffected","modules":["Chat message rendering and URL linkification"],"programFiles":["static/chat-ui.js"],"programRoutines":[{"name":"escapeHtml"},{"name":"linkifyUrls"}],"repo":"https://github.com/madpsy/ka9q_ubersdr","versions":[{"version":"0","lessThan":"0.1.58","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:50:40.419100Z","id":"CVE-2026-97723","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/madpsy/ka9q_ubersdr/commit/6aa858da1c030cae11b94c7d6c72322adb9ec60d","source":"cve@mitre.org"},{"url":"https://github.com/madpsy/ka9q_ubersdr/pull/114","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-97650","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T03:16:59.087","lastModified":"2026-09-25T14:17:25.903","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function echo of the file admin/fun/addLog.php. The manipulation of the argument reason/detail leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"ningzichun","product":"student-management-system","cpes":["cpe:2.3:a:ningzichun:student-management-system:*:*:*:*:*:*:*:*"],"versions":[{"version":"98760f5711cf6dc8b4adca53a9e207ca49b02ebf","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:44:13.011342Z","id":"CVE-2026-97650","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/ningzichun/student-management-system/","source":"cna@vuldb.com"},{"url":"https://github.com/ningzichun/student-management-system/issues/11","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97650","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/910059","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409752","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409752/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97724","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T03:16:59.327","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePlainJSObject in packages/react-native-worklets/src/memory/serializable.native.ts. When affected data is subsequently processed by React Native Worklets, the malformed serialized object can cause the React Native application to crash. This can result in a remotely triggered denial of service in applications that pass attacker-controlled data through the affected serialization path. In applications where the attacker-controlled data is persisted, the denial of service may persist across application restarts or repeated attempts to access the affected content."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"swmansion","product":"React Native Reanimated","defaultStatus":"unaffected","modules":["react-native-worklets serialization"],"platforms":["Android","iOS"],"programFiles":["packages/react-native-worklets/src/memory/serializable.native.ts"],"programRoutines":[{"name":"clonePlainJSObject"}],"repo":"https://github.com/software-mansion/react-native-reanimated","packageURL":"pkg:npm/react-native-worklets","versions":[{"version":"worklets-0.5.0","lessThan":"worklets-0.12.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:D/RE:L/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"LOW","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:54:55.193703Z","id":"CVE-2026-97724","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-1321"}]}],"references":[{"url":"https://docs.swmansion.com/react-native-reanimated/","source":"cve@mitre.org"},{"url":"https://github.com/software-mansion/react-native-reanimated/issues/10436","source":"cve@mitre.org"},{"url":"https://github.com/software-mansion/react-native-reanimated/pull/10451","source":"cve@mitre.org"},{"url":"https://github.com/software-mansion/react-native-reanimated/pull/10462","source":"cve@mitre.org"},{"url":"https://github.com/software-mansion/react-native-reanimated/releases/tag/worklets-0.12.2","source":"cve@mitre.org"},{"url":"https://github.com/software-mansion/react-native-reanimated/issues/10436","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97730","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T03:16:59.533","lastModified":"2026-09-30T17:23:08.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Netgate","product":"pfSense Plus","defaultStatus":"unaffected","modules":["webgui (Dashboard widget layout)"],"platforms":["FreeBSD"],"programFiles":["index.php"],"versions":[{"version":"0","lessThan":"26.07","versionType":"custom","status":"affected"}]},{"vendor":"Netgate","product":"pfSense CE","defaultStatus":"unaffected","modules":["webgui"],"platforms":["FreeBSD"],"programFiles":["index.php"],"versions":[{"version":"0","lessThan":"2.9.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:41:31.034516Z","id":"CVE-2026-97730","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-24"}]}],"references":[{"url":"https://docs.netgate.com/downloads/pfSense-SA-26_18.webgui.asc","source":"cve@mitre.org"},{"url":"https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html","source":"cve@mitre.org"},{"url":"https://redmine.pfsense.org/attachments/7146","source":"cve@mitre.org"},{"url":"https://redmine.pfsense.org/issues/16947","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-97731","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T03:16:59.697","lastModified":"2026-09-30T17:23:08.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a header that arrives unsigned is neither hashed into the canonical request nor rejected. Because cmd/api-router.go dispatches CopyObject on the presence of x-amz-copy-source alone, the holder of a presigned PUT URL scoped to a single object can add that header to the unmodified URL and cause a server-side copy, executed as the signer, of any object the signing key can read. A grant to write one object becomes a read of every bucket that key can reach. Amazon S3 rejects the equivalent request with HTTP 403 AccessDenied. The minio/minio GitHub repository was archived in April 2026; pgsty/silo before 1233254 is also affected."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"MinIO","product":"MinIO","defaultStatus":"unaffected","repo":"https://github.com/minio/minio","versions":[{"version":"0","lessThanOrEqual":"7aac2a2c5b7c882e68c1ce017d8256be2feea27f","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:22:42.586752Z","id":"CVE-2026-97731","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://github.com/pgsty/silo/commit/1233254309b15571f101b2b26d531951ceaeef1e","source":"cve@mitre.org"},{"url":"https://silo.pgsty.com/about/security-advisories/#sn-2026-011","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2025-14814","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T04:17:31.093","lastModified":"2026-10-14T13:10:00.187","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."},{"lang":"es","value":"El plugin CSS & JavaScript Toolbox para WordPress es vulnerable a cross-site scripting almacenado a través del shortcode cjtoolbox del plugin en todas las versiones hasta la 12.0.6, inclusive, debido a una sanitización insuficiente de las entradas y un escape inadecuado de las salidas en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de nivel de colaborador o superior, inyectar scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wipeoutmedia","product":"CSS & JavaScript Toolbox","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"12.0.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:53:28.656283Z","id":"CVE-2025-14814","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3667323/css-javascript-toolbox","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b20e71d3-627e-49e0-a2f7-20cdbb8622e7?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-97732","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T04:17:50.537","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WIN_CERTIFICATE data (\"IRONMACE Co., Ltd.\" and \"DigiCert Trusted Root G4\") instead of parsing and validating the PKCS signature data. As a result, a local unprivileged attacker may bypass this via crafted certificate data and obtain access to privileged IOCTL functionality."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"IRONMACE","product":"Ironshield","defaultStatus":"unknown","modules":["tvk.sys kernel-mode driver"],"platforms":["Windows"],"versions":[{"version":"1.0.0.167","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:42:40.635415Z","id":"CVE-2026-97732","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://github.com/hseoa/ironshield-analysis","source":"cve@mitre.org"},{"url":"https://store.steampowered.com/eula/2016590_eula_0","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-97735","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T04:17:50.763","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"ITFlow","product":"ITFlow","defaultStatus":"unaffected","repo":"https://github.com/itflow-org/itflow","versions":[{"version":"0","lessThan":"26.08","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:54:20.076459Z","id":"CVE-2026-97735","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/itflow-org/itflow/commit/16000efcf7f7c833aae9f8da22d2a82df21a49c0","source":"cve@mitre.org"},{"url":"https://github.com/itflow-org/itflow/security/advisories/GHSA-89fw-w69c-vghj","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-97736","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T04:17:50.977","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"tinyauth","product":"tinyauth","defaultStatus":"unaffected","collectionURL":"https://proxy.golang.org","packageName":"github.com/tinyauthapp/tinyauth","modules":["forward-auth per-app path ACL"],"programFiles":["internal/service/access_controls_rules.go"],"repo":"https://github.com/tinyauthapp/tinyauth","versions":[{"version":"0","lessThan":"5.1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:41:43.626491Z","id":"CVE-2026-97736","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-777"}]}],"references":[{"url":"https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-r27r-rr9v-vv37","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-97737","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T05:17:07.760","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"muety","product":"Wakapi","defaultStatus":"unaffected","modules":["user caching service (services/user.go)"],"programFiles":["services/user.go"],"repo":"https://github.com/muety/wakapi","packageURL":"pkg:golang/github.com/muety/wakapi","versions":[{"version":"0","lessThan":"2.17.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:26:53.957707Z","id":"CVE-2026-97737","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://github.com/muety/wakapi/commit/ce91eac2c2d9b29a00873554d2ecef76f10b9087","source":"cve@mitre.org"},{"url":"https://github.com/muety/wakapi/releases/tag/2.17.6","source":"cve@mitre.org"},{"url":"https://github.com/muety/wakapi/security/advisories/GHSA-x48w-3rq3-w2pq","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-97764","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T05:17:07.953","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"allauth","product":"django-allauth","defaultStatus":"unaffected","collectionURL":"https://pypi.org","packageName":"django-allauth","modules":["allauth.account.utils","allauth.account.adapter.DefaultAccountAdapter"],"programFiles":["allauth/account/utils.py","allauth/account/adapter.py"],"programRoutines":[{"name":"allauth.account.utils.filter_users_by_username()"},{"name":"allauth.account.utils.filter_users_by_email()"},{"name":"allauth.account.utils._unicode_ci_compare()"},{"name":"allauth.account.adapter.DefaultAccountAdapter._get_login_attempts_cache_key()"}],"repo":"https://codeberg.org/allauth/django-allauth","packageURL":"pkg:pypi/django-allauth","versions":[{"version":"0.25.0","lessThan":"65.19.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:37:23.042548Z","id":"CVE-2026-97764","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-180"}]}],"references":[{"url":"https://codeberg.org/allauth/django-allauth/commit/4379e7931fe7572aacc4f3b4b5f2298d5f3ecc96","source":"cve@mitre.org"},{"url":"https://codeberg.org/allauth/django-allauth/commit/4e252aa2be7cef5d72d78049d6fb07cb27a89c83","source":"cve@mitre.org"},{"url":"https://codeberg.org/allauth/django-allauth/commit/ae472772c8f93bcb972205c9d7159051cf6f413a","source":"cve@mitre.org"},{"url":"https://docs.allauth.org/en/latest/release-notes/recent.html","source":"cve@mitre.org"},{"url":"https://pypi.org/project/django-allauth/","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-97818","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T05:17:08.120","lastModified":"2026-10-06T22:10:00.247","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"phpIPAM through 1.8.3 has incorrect authorization for id==\"admins\" and id==\"all\" in api/controllers/User.php."},{"lang":"es","value":"phpIPAM hasta la versión 1.8.3 presenta una autorización incorrecta para id='admins' y id='all' en API/controllers/User.php."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"phpipam","product":"phpIPAM","defaultStatus":"unknown","programFiles":["api/controllers/User.php"],"repo":"https://github.com/phpipam/phpipam","versions":[{"version":"0","lessThanOrEqual":"1.8.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:53:40.833250Z","id":"CVE-2026-97818","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/api/controllers/User.php#L143-L146","source":"cve@mitre.org"},{"url":"https://github.com/phpipam/phpipam/releases/tag/v1.8.3","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-97721","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T06:16:52.347","lastModified":"2026-09-29T20:17:31.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. This vulnerability affects the function CmsContentAdminController of the file publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/sys/SysUserAdminController.java of the component exportExcel/exportData. This manipulation of the argument userId/deptId causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"es","value":"Se ha identificado una vulnerabilidad en Sanluan PublicCMS hasta la versión 6.202506.e. Esta vulnerabilidad afecta a la función CmsContentAdminController del archivo publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/sys/SysUserAdminController.java del componente exportExcel/exportData. Esta manipulación del argumento userId/deptId provoca una elusión de autorización. Es posible iniciar el ataque de forma remota. El exploit ha sido puesto a disposición del público y podría ser utilizado para ataques. Se contactó al proveedor con antelación sobre esta divulgación, pero no respondió de ninguna manera."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Sanluan","product":"PublicCMS","cpes":["cpe:2.3:a:publiccms:publiccms:*:*:*:*:*:*:*:*"],"modules":["exportExcel/exportData"],"versions":[{"version":"6.202506.a","status":"affected"},{"version":"6.202506.b","status":"affected"},{"version":"6.202506.c","status":"affected"},{"version":"6.202506.d","status":"affected"},{"version":"6.202506.e","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:N/A:N","baseScore":3.3,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.4,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:08:34.073456Z","id":"CVE-2026-97721","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/aibot88/CVERequest/blob/main/PublicCMS/issue7.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97721","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/910956","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409820","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409820/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-14281","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:53.540","lastModified":"2026-09-25T13:08:26.930","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()` — allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP verification is enabled at signup, the OTP session token (`otp_transient`) is returned in plaintext in the HTTP response body, and the `handle_magic_link_request()` handler marks that token as verified on any unauthenticated GET request containing it without ever checking the OTP code value — making the OTP step trivially bypassable with no inbox or SMS access required."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"101gen","product":"Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.8.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T10:34:38.917641Z","id":"CVE-2026-14281","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/api/class-wawp-rest-settings-api.php#L342","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/api/class-wawp-rest-settings-api.php#L574","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-otp-service.php#L477","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-otp-service.php#L787","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-signup.php#L1002","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-signup.php#L845","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/api/class-wawp-rest-settings-api.php#L342","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/api/class-wawp-rest-settings-api.php#L574","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-otp-service.php#L477","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-otp-service.php#L787","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-signup.php#L1002","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-signup.php#L845","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3679350%40automation-web-platform&new=3679350%40automation-web-platform","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f17d3e43-29c6-4c80-912d-53ceda3fcb5d?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-19775","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:53.857","lastModified":"2026-09-25T14:17:18.353","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read the title, status, date, permalink, and a 300-character content excerpt of any private, draft, pending, or future post, as well as the content and AI-moderation verdicts of unapproved and spam comments. Any authenticated user with the 'read' capability can self-enable the required AI feature by visiting the /openstation/ portal and toggling their own ai.enabled setting via the POST /desktop-mode/v1/os-settings endpoint, removing any practical barrier to exploitation."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"allterraindeveloper","product":"OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.1.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:53:00.497813Z","id":"CVE-2026-19775","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/desktop-mode/tags/1.0.1/includes/ai-copilot/search.php#L1244","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/desktop-mode/tags/1.0.1/includes/ai-copilot/search.php#L1851","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/desktop-mode/tags/1.0.1/includes/ai-copilot/search.php#L1945","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/desktop-mode/tags/1.0.1/includes/ai-copilot/search.php#L628","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3692599%40desktop-mode&new=3692599%40desktop-mode","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b34e3be3-78d5-4e61-a8e9-05d4b06d630b?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-62062","sourceIdentifier":"audit@patchstack.com","published":"2026-09-25T07:16:54.010","lastModified":"2026-09-25T14:17:18.807","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery.\n\nThis issue affects Elementor Website Builder: from n/a through 4.3.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Elementor","product":"Elementor Website Builder","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"elementor","versions":[{"version":"n/a","lessThanOrEqual":"4.3.1","versionType":"custom","status":"affected","changes":[{"at":"4.3.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:29:54.745121Z","id":"CVE-2026-62062","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-75553","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-09-25T07:16:54.170","lastModified":"2026-09-29T21:39:02.570","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Smartphone application Tohoku Electric Power \"Yorisou e Net\" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a hard-coded cryptographic key from the affected product."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"Tohoku Electric Power Company, Incorporated","product":"Tohoku Electric Power \"Yorisou e Net\" Android App","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.8.0","versionType":"semver","status":"affected"}]},{"vendor":"Tohoku Electric Power Company, Incorporated","product":"Tohoku Electric Power \"Yorisou e Net\" iOS App","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.8.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.4,"baseSeverity":"LOW","attackVector":"PHYSICAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":2.4,"baseSeverity":"LOW","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:32:10.369668Z","id":"CVE-2026-75553","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"references":[{"url":"https://apps.apple.com/jp/app/%E6%9D%B1%E5%8C%97%E9%9B%BB%E5%8A%9B-%E3%82%88%E3%82%8A%E3%81%9D%E3%81%86%EF%BD%85%E3%81%AD%E3%81%A3%E3%81%A8/id1420949327?l=en-US","source":"vultures@jpcert.or.jp"},{"url":"https://jvn.jp/en/jp/JVN93985674/","source":"vultures@jpcert.or.jp"},{"url":"https://play.google.com/store/apps/details?id=jp.co.tohokuepco.enet&hl=ja","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-78393","sourceIdentifier":"contact@wpscan.com","published":"2026-09-25T07:16:54.327","lastModified":"2026-09-25T13:25:48.533","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to Reflected Cross-Site Scripting which could be used against any visitor, including logged-in administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Link Library","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"7.9.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:36:56.513978Z","id":"CVE-2026-78393","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/2605888a-195d-4bce-8aac-347710ad1de8/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-78394","sourceIdentifier":"contact@wpscan.com","published":"2026-09-25T07:16:54.437","lastModified":"2026-09-25T13:25:48.533","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root.\n\nThe written file name is always numeric with a fixed image extension, so executable code cannot be planted this way."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Link Library","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"7.9.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:37:04.268157Z","id":"CVE-2026-78394","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://wpscan.com/vulnerability/9da07b4f-5332-4ba5-8a34-6f2ed303b62c/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-78397","sourceIdentifier":"contact@wpscan.com","published":"2026-09-25T07:16:54.530","lastModified":"2026-09-25T13:25:48.533","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered.\n\nVersions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link submission form with reciprocal-link validation enabled."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Link Library","defaultStatus":"unaffected","versions":[{"version":"7.8.8","lessThan":"7.9.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":4.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:37:14.730842Z","id":"CVE-2026-78397","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://wpscan.com/vulnerability/7842ef44-582c-40a8-8f3c-cf8abebaf7fb/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-83591","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:54.747","lastModified":"2026-09-25T14:17:19.413","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all versions up to, and including, 1.1.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The crafted payload uses only WordPress-permitted comment tags and attributes (an anchor with href and title), and the AMP sanitizer pipeline omits javascript: protocol blocking, meaning neither the comment save filter nor the AMP output stage removes the malicious URI introduced by the transformation."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"mohammed_kaludi","product":"AMP for WP – Accelerated Mobile Pages","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.1.16","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:53:38.925235Z","id":"CVE-2026-83591","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.14/components/comments/comments.php#L89","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.14/includes/features/functions.php#L314","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.14/templates/features.php#L8823","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.15/components/comments/comments.php#L89","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.15/includes/features/functions.php#L314","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.15/templates/features.php#L8823","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3689899%40accelerated-mobile-pages&new=3689899%40accelerated-mobile-pages","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47ef0e19-8b67-42ad-b8e9-72b0dbe5e3a5?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-84279","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:54.890","lastModified":"2026-09-25T14:17:19.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Pro Export/Genius feature to be enabled on the site, as the vulnerable fpd_pr_export AJAX action is only registered when that feature is active."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"radykal","product":"Fancy Product Designer","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:53:47.840124Z","id":"CVE-2026-84279","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://fancyproductdesigner.com/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa9e0489-effd-4235-a6a9-2bece0fe2abf?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-84281","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:55.013","lastModified":"2026-09-25T13:08:26.930","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fpd_save_order AJAX action is registered for unauthenticated users via wp_ajax_nopriv_fpd_save_order with no nonce or capability check, and the strip_tags() sanitization applied at save time is bypassed by submitting JSON unicode escape sequences (e.g. \\u003c, \\u003e), which json_decode() silently converts back to literal angle brackets when the order is rendered in the admin view."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"radykal","product":"Fancy Product Designer","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T10:38:59.789891Z","id":"CVE-2026-84281","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://fancyproductdesigner.com/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53a70698-f2ee-4694-b21c-8b8ccb0b2a5c?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-89055","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:55.140","lastModified":"2026-09-25T14:17:21.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary attachments from the Media Library — including administrator-owned product images, logos, and documents — by injecting their IDs into a review that is later trashed and purged. Exploitation requires a public review-form link (a 13-hex formId distributed to customers via e-mail), which exposes the nonce needed to reach the handler without any WordPress account or session."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"ivole","product":"Customer Reviews for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.120.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:53:57.559915Z","id":"CVE-2026-89055","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.120.0/includes/reminders/class-cr-local-forms-ajax.php#L57","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.120.0/includes/reviews/class-cr-endpoint.php#L318","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.120.0/includes/reviews/class-cr-endpoint.php#L467","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.120.0/includes/reviews/class-cr-reviews.php#L129","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.120.0/includes/reviews/class-cr-reviews.php#L1871","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3694303%40customer-reviews-woocommerce&new=3694303%40customer-reviews-woocommerce","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7bbeeea-3888-42a6-8d14-f5c39f5dcb70?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-92212","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:55.337","lastModified":"2026-09-25T14:17:21.880","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted page to host a form configured with both a URL Query Variable preset field and a Calculated Field that references it, which are standard plugin features."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"jetmonsters","product":"JetFormBuilder — Dynamic Blocks Form Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.6.5.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:53:18.259099Z","id":"CVE-2026-92212","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/assets/build/frontend/main.js","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/includes/blocks/render/calculated-field-render.php#L42","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/includes/presets/sources/preset-source-query-var.php#L21","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/templates/fields/calculated-field.php#L31","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3707612%40jetformbuilder&new=3707612%40jetformbuilder","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37a72530-35d0-4fe8-82c6-50c87f61e731?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-92746","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:55.473","lastModified":"2026-09-25T14:17:22.603","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core wp_kses_post sanitization does not mitigate this vulnerability because the payload is stored inside a Gutenberg block delimiter comment rather than as a raw HTML tag, and is only rendered as exploitable HTML at the PHP render stage."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"jegstudio","product":"Gutenverse – WordPress Blocks, Page Builder & Site Editor","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.0.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:51:54.468906Z","id":"CVE-2026-92746","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/gutenverse/tags/4.0.8/includes/block/class-post-comment.php#L51","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/gutenverse/tags/4.0.8/includes/block/class-post-comment.php#L80","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3710420/gutenverse/trunk/includes/block/class-post-comment.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e35f9e09-c386-4e37-9d81-8dd2863457ac?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-92799","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:55.607","lastModified":"2026-09-25T13:08:26.930","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the `postValidateCustomer()` function using a loose PHP inequality operator (`!=`) to compare the session-stored one-time verification code against the attacker-supplied `verification_code` parameter — a flaw that is further exposed by the booking AJAX controller registering all its methods as `wp_ajax_nopriv_` handlers and unconditionally overriding `csrfTokenValid()` to return true, leaving the endpoint both unauthenticated and CSRF-unprotected. This makes it possible for unauthenticated attackers to bypass the phone/email ownership verification step and overwrite the name, email, phone, and address fields of any arbitrary existing Bookly customer record, redirecting that customer's booking notifications to attacker-controlled contact details. The bypass is achievable because the `json_data` input channel decodes input via `json_decode()`, which preserves real PHP types and causes the `wp_kses` filter to leave non-string values such as the JSON boolean `true` untouched; submitting `true` as the `verification_code` satisfies the loose comparison against the session's non-zero integer code (generated by `mt_rand(100000, 999999)`), causing `true != <non-zero int>` to evaluate as `false` and the guard to be bypassed."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"ladela","product":"Online Scheduling and Appointment Booking System – Bookly","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"28.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T10:35:41.040639Z","id":"CVE-2026-92799","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/frontend/modules/booking/Ajax.php#L1447","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/frontend/modules/booking/Ajax.php#L15","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/frontend/modules/booking/Ajax.php#L785","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/frontend/modules/booking/Ajax.php#L903","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/lib/UserBookingData.php#L638","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/lib/Validator.php#L276","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/lib/base/Component.php#L182","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3707284%40bookly-responsive-appointment-booking-tool&new=3707284%40bookly-responsive-appointment-booking-tool","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d24fa600-7698-4081-92f5-e11606928886?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-92829","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:55.750","lastModified":"2026-09-25T14:17:22.717","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to view, modify, or delete other users' Blog2Social records, including disclosing another user's network authentication IDs and scheduled post content, overwriting Open Graph and Twitter Card post metadata on posts they do not own, rebinding another user's social-network authorization, and mass-hiding all users' scheduled posts sitewide. The plugin's b2s_security_nonce is emitted on the post-edit meta box, which Contributors can render, making the nonce available to any authenticated user at that role level or above."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"pr-gateway","product":"Blog2Social: Social Media Auto Post & Scheduler","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"9.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:52:50.739317Z","id":"CVE-2026-92829","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/blog2social/tags/9.1.0/includes/Ajax/Get.php#L695","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/blog2social/tags/9.1.0/includes/Ajax/Post.php#L1859","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/blog2social/tags/9.1.0/includes/Ajax/Post.php#L2302","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/blog2social/tags/9.1.0/includes/Ajax/Post.php#L2572","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/blog2social/tags/9.1.0/includes/Ajax/Post.php#L4475","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/blog2social/tags/9.1.0/includes/B2S/Calendar/Filter.php#L218","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/blog2social/tags/9.1.0/includes/B2S/Post/Tools.php#L166","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/blog2social/tags/9.1.1/includes/Ajax/Post.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c712972d-c6b2-46be-8c93-27a7e7c920a0?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93303","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:55.890","lastModified":"2026-09-25T14:17:22.830","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume in all versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires tricking a user into clicking an attacker-supplied draft resume URL, which the attacker constructs using the draft_key and access_token returned directly in the save response."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"htplugins","product":"HT Contact Form – Drag & Drop Form Builder for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.10.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:52:13.550736Z","id":"CVE-2026-93303","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.10.1/admin/Includes/Api/Endpoints/Draft.php#L199","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.10.1/admin/Includes/Api/Endpoints/Draft.php#L336","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.10.1/admin/Includes/Api/Endpoints/Draft.php#L74","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.10.1/admin/Includes/Models/Drafts.php#L239","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.10.1/assets/js/form.js#L2053","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.10.1/include/UI/ShortCode.php#L726","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3707224%40ht-contactform&new=3707224%40ht-contactform","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5c3702c-65d3-4b89-a78f-6df267b02a1e?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93399","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:56.027","lastModified":"2026-09-26T23:16:39.480","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from the submitted form_data into a new booking session, which the 'bookly_render_complete' handler then trusts to look up and return the corresponding Order's secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers' order tokens, retrieve calendar/appointment information via 'bookly_add_to_calendar' and permanently delete arbitrary non-completed bookings via 'bookly_rollback_order', which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"ladela","product":"Online Scheduling and Appointment Booking System – Bookly","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"28.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:41:58.276787Z","id":"CVE-2026-93399","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/frontend/modules/booking/Ajax.php#L1111","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/frontend/modules/booking/Ajax.php#L46","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/frontend/modules/booking/Ajax.php#L733","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/frontend/modules/payment/Ajax.php#L74","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/lib/UserBookingData.php#L360","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/lib/base/Gateway.php#L301","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3707284%40bookly-responsive-appointment-booking-tool&new=3707284%40bookly-responsive-appointment-booking-tool","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d45a01e5-0e69-4d95-b609-b9002b3776da?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93477","sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","published":"2026-09-25T07:16:56.163","lastModified":"2026-09-25T14:17:23.093","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.\n\nAction arguments declared with public?: false are meant to be set only by trusted server-side code (for example via Ash.Changeset.set_private_argument/3) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.\n\nAsh.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 match every key in the caller-supplied parameter map against all of the action's arguments with no public? check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to Ash.bulk_destroy/4 or Ash.bulk_update/4) can therefore set any private argument of that action, including one referenced by an arg(...) template in the action's changes or validations. Depending on how the application uses the argument (for example an acting_user_id driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.\n\nThe fix requires public? in the argument matching on both bulk paths; private arguments remain settable server-side via the :private_arguments option.\n\nThis issue affects ash: from 2.17.15 before 3.33.11."}],"affected":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","affectedData":[{"vendor":"ash-project","product":"ash","defaultStatus":"unaffected","collectionURL":"https://repo.hex.pm","packageName":"ash","cpes":["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Ash.Actions.Destroy.Bulk'","'Elixir.Ash.Actions.Update.Bulk'"],"programFiles":["lib/ash/actions/destroy/bulk.ex","lib/ash/actions/update/bulk.ex"],"programRoutines":[{"name":"'Elixir.Ash.Actions.Destroy.Bulk':base_changeset/5"},{"name":"'Elixir.Ash.Actions.Update.Bulk':base_changeset/5"}],"repo":"https://github.com/ash-project/ash","packageURL":"pkg:hex/ash","versions":[{"version":"2.17.15","lessThan":"3.33.11","versionType":"semver","status":"affected"}]},{"vendor":"ash-project","product":"ash","defaultStatus":"unaffected","collectionURL":"https://github.com","packageName":"ash-project/ash","cpes":["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Ash.Actions.Destroy.Bulk'","'Elixir.Ash.Actions.Update.Bulk'"],"programFiles":["lib/ash/actions/destroy/bulk.ex","lib/ash/actions/update/bulk.ex"],"programRoutines":[{"name":"'Elixir.Ash.Actions.Destroy.Bulk':base_changeset/5"},{"name":"'Elixir.Ash.Actions.Update.Bulk':base_changeset/5"}],"repo":"https://github.com/ash-project/ash","packageURL":"pkg:github/ash-project/ash","versions":[{"version":"8c17434803b2e91de522bdfbd0ca918e5d5898df","lessThan":"6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:26:14.200048Z","id":"CVE-2026-93477","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","description":[{"lang":"en","value":"CWE-915"}]}],"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-93477.html","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ash-project/ash/commit/6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ash-project/ash/commit/8c17434803b2e91de522bdfbd0ca918e5d5898df","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ash-project/ash/security/advisories/GHSA-c2p4-p7q6-hr2j","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-93477","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ash-project/ash/security/advisories/GHSA-c2p4-p7q6-hr2j","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-93897","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:56.370","lastModified":"2026-09-25T14:17:24.443","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload must be stored in a text-type custom field (such as a phone field) via the AJAX geodir_save_post endpoint, using entity-encoded angle brackets (e.g., &lt;img src=x onerror=alert(1)&gt;) to bypass the strpos()-gated tag-stripping check."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"paoltaia","product":"GeoDirectory – WP Business Directory Plugin and Classified Listings Directory","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.8.181","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:27:54.980163Z","id":"CVE-2026-93897","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.181/includes/class-geodir-ajax.php#L821","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.181/includes/formatting-functions.php#L56","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.181/includes/post-functions.php#L1347","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.181/includes/post-functions.php#L1803","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3705730%40geodirectory&new=3705730%40geodirectory","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1390b079-784c-4c36-bec4-a70cd8484ca5?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93899","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:56.500","lastModified":"2026-09-25T14:17:24.560","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'group_id' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the BuddyBoss Platform plugin to be installed with its Social Groups component disabled, a state that persists on any site that has previously toggled the Groups component off since BuddyBoss does not drop the wp_bp_groups table upon deactivation."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wordplus","product":"Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.0.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:53:09.482804Z","id":"CVE-2026-93899","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/3.0.3/addons/buddyboss.php#L626","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/3.0.3/addons/buddyboss.php#L635","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/3.0.3/inc/functions.php#L3323","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/3.0.3/inc/rest-api.php#L1073","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=bp-better-messages%2Ftags%2F3.0.3%2Faddons%2Fbuddyboss.php&new_path=bp-better-messages%2Ftags%2F3.0.5%2Faddons%2Fbuddyboss.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/553a9a16-97e0-4443-9d4b-dd901b86141b?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-94376","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:56.753","lastModified":"2026-09-25T14:17:24.803","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because WordPress core's sanitize_text_field() preserves HTML-entity-encoded payloads (e.g., an iframe srcdoc attribute), allowing the encoded string to be stored as a display name without requiring the unfiltered_html capability, and the plugin subsequently decodes it server-side before rendering."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wordplus","product":"Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.0.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:51:44.332589Z","id":"CVE-2026-94376","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/3.0.3/inc/functions.php#L1117","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/3.0.3/inc/functions.php#L2276","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=bp-better-messages%2Ftags%2F3.0.3%2Faddons%2Fbuddyboss.php&new_path=bp-better-messages%2Ftags%2F3.0.5%2Faddons%2Fbuddyboss.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4f5a268-7e7f-4dbe-823a-a17ac0f52928?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96039","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:56.880","lastModified":"2026-09-25T14:17:25.337","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit chain reachable without any account."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"bookingalgorithms","product":"BA Book Everything","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.8.27","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:52:23.970286Z","id":"CVE-2026-96039","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ba-book-everything/tags/1.8.27/includes/class-babe-html.php#L4300","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ba-book-everything/tags/1.8.27/includes/class-babe-order.php#L2405","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ba-book-everything/tags/1.8.27/includes/class-babe-order.php#L2522","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ba-book-everything/tags/1.8.27/includes/class-babe-order.php#L2599","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ba-book-everything/tags/1.8.27/includes/class-babe-order.php#L2653","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3709588%40ba-book-everything%2Ftrunk&old=3640320%40ba-book-everything%2Ftrunk","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd118053-b0f7-4fce-aa00-b0bb40778f21?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96766","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T07:16:57.017","lastModified":"2026-09-25T13:08:08.163","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_hours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the AJAX save handler validates only post authorship and a nonce with no additional capability check, allowing any subscriber-level user who owns a listing to exploit this vulnerability."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"paoltaia","product":"GeoDirectory – WP Business Directory Plugin and Classified Listings Directory","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.8.183","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T10:37:49.691722Z","id":"CVE-2026-96766","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.182/includes/business-hours-functions.php#L965","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.182/includes/class-geodir-ajax.php#L821","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.182/includes/class-geodir-post-data.php#L1661","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.182/includes/custom-fields/input-functions-aui.php#L2278","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3710682%40geodirectory&new=3710682%40geodirectory","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc743651-cfbc-487b-9d1b-9aab6d3a57b7?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-97846","sourceIdentifier":"secalert@redhat.com","published":"2026-09-25T07:16:57.147","lastModified":"2026-09-25T14:17:26.973","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:52:32.447170Z","id":"CVE-2026-97846","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-97846","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2540949","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-12037","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:38.490","lastModified":"2026-09-25T14:17:17.857","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'page_url' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This vulnerability is only reachable when the plugin's dom_get_type setting has been configured to 'wp_remote_post' by an administrator."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"gabelivan","product":"Asset CleanUp: Page Speed Booster","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.4.0.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:49:47.927699Z","id":"CVE-2026-12037","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-asset-clean-up/tags/1.4.0.3/classes/Admin/MainAdmin.php#L1067","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-asset-clean-up/tags/1.4.0.3/classes/Admin/MainAdmin.php#L1095","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-asset-clean-up/tags/1.4.0.3/classes/Admin/MainAdmin.php#L315","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-asset-clean-up/tags/1.4.0.4/classes/Admin/MainAdmin.php#L1067","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-asset-clean-up/tags/1.4.0.4/classes/Admin/MainAdmin.php#L1095","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-asset-clean-up/tags/1.4.0.4/classes/Admin/MainAdmin.php#L315","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3699024%40wp-asset-clean-up&new=3699024%40wp-asset-clean-up","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af1e638d-9fc8-4584-a138-8d6316fbfcad?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-13179","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:39.820","lastModified":"2026-09-25T14:17:17.977","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapes_values Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fc-call-nonce nonce required by the endpoint is exposed to all frontend visitors who view a map page via window.wpgmp_local.nonce, enabling any authenticated subscriber to read the nonce and craft a valid request; additionally, the secondary _wpnonce check in the drawing handler can be bypassed by simply omitting the _wpnonce parameter from the request."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"flippercode","product":"WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.9.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:50:26.507172Z","id":"CVE-2026-13179","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.3/assets/js/maps.js#L8477","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.3/modules/drawing/views/manage.php#L32","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.3/modules/shortcode/views/put-wpgmp.php#L1263","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.3/wp-google-map-plugin.php#L605","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.3/wp-google-map-plugin.php#L619","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.5/assets/js/maps.js#L8477","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.5/modules/drawing/views/manage.php#L32","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.5/modules/shortcode/views/put-wpgmp.php#L1263","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.5/wp-google-map-plugin.php#L605","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.5/wp-google-map-plugin.php#L619","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3690856%40wp-google-map-plugin&new=3690856%40wp-google-map-plugin","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c664543-1ca1-4ba8-a6c6-f32a560bc690?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-13456","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:39.970","lastModified":"2026-09-25T14:17:18.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"flippercode","product":"WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.9.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:51:34.640127Z","id":"CVE-2026-13456","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-98"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.3/core/class.controller.php#L115","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.3/wp-google-map-plugin.php#L605","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.3/wp-google-map-plugin.php#L622","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.5/core/class.controller.php#L115","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.5/wp-google-map-plugin.php#L605","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.5/wp-google-map-plugin.php#L622","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3690856%40wp-google-map-plugin&new=3690856%40wp-google-map-plugin","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/404a3124-bff7-4d92-8424-5b21382031f2?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-17577","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:40.103","lastModified":"2026-09-25T13:08:08.163","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters in versions up to, and including, 4.7.42. The ssl_zen_messages::getMessages() function builds the 'token_missmatch' message using base64_decode(sanitize_text_field($_REQUEST['uri'])) and (optionally) base64_decode(sanitize_text_field($_REQUEST['host'])). sanitize_text_field() cannot strip HTML/JavaScript that is hidden inside a base64-encoded blob, and the resulting decoded raw HTML is echoed unescaped by showMessage() . This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"sslzen","product":"SSL Zen — SSL Certificate Installer & HTTPS Redirects","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.7.42","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T10:31:30.444491Z","id":"CVE-2026-17577","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.14/ssl_zen/classes/class.ssl_zen_admin.php#L863","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.14/ssl_zen/classes/class.ssl_zen_messages.php#L44","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.42/ssl_zen/classes/class.ssl_zen_admin.php#L863","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.42/ssl_zen/classes/class.ssl_zen_messages.php#L44","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3701590%40ssl-zen&new=3701590%40ssl-zen","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20816039-0b1c-420a-b5f4-b5370d0331da?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-17602","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:40.247","lastModified":"2026-09-25T14:17:18.233","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'file_name' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"sslzen","product":"SSL Zen — SSL Certificate Installer & HTTPS Redirects","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.7.42","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:50:55.856628Z","id":"CVE-2026-17602","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.12/ssl_zen/classes/class.ssl_zen_admin.php#L492","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.12/ssl_zen/classes/class.ssl_zen_admin.php#L496","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.12/ssl_zen/classes/class.ssl_zen_admin.php#L54","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.42/ssl_zen/classes/class.ssl_zen_admin.php#L492","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.42/ssl_zen/classes/class.ssl_zen_admin.php#L496","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ssl-zen/tags/4.7.42/ssl_zen/classes/class.ssl_zen_admin.php#L54","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3701590%40ssl-zen&new=3701590%40ssl-zen","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf4cc39-3a26-462d-a540-2d53e53dfa66?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-19804","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:40.383","lastModified":"2026-09-25T14:17:18.497","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'first_name' parameter parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request on the target site."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"clavaque","product":"s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"260814","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:49:31.243312Z","id":"CVE-2026-19804","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-checkout-in.inc.php#L736","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-return-in-subscr-or-wa-w-level.inc.php#L311","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-return-in-subscr-or-wa-w-level.inc.php#L319","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-return-in.inc.php#L47","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-utilities.inc.php#L185","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-utilities.inc.php#L92","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/tracking-codes.inc.php#L71","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/utilities.inc.php#L49","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3671073%40s2member&new=3671073%40s2member","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e87da8fa-04cc-4b9a-9dde-be7d4f2bd76e?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-84280","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:40.550","lastModified":"2026-09-25T14:17:19.653","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is written to the DOM via innerHTML within the beforeElementAdd JavaScript event handler when processing the elements[].title field from the stored order JSON, meaning execution occurs specifically when an administrator reviews shortcode orders in the WordPress admin panel."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"radykal","product":"Fancy Product Designer","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:49:56.266392Z","id":"CVE-2026-84280","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://fancyproductdesigner.com/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4c1e5eb-324e-4841-afd0-c59b319ddd0e?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-88996","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:40.670","lastModified":"2026-09-25T13:08:08.163","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'page_title' POST Parameter via {page_title} Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on forms whose admin-authored confirmation message places the {page_title} Smart Tag inside an HTML attribute context."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"smub","product":"WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T10:31:56.123505Z","id":"CVE-2026-88996","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.1.1/includes/class-process.php#L1718","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.1.1/src/Frontend/Classic.php#L297","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.1.1/src/SmartTags/SmartTag/PageTitle.php#L33","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/2.0.1.1/src/SmartTags/SmartTags.php#L482","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3709178%40wpforms-lite&new=3709178%40wpforms-lite","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a10570c-542a-494c-9dea-96a58b91139e?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-89406","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:40.803","lastModified":"2026-09-25T14:17:21.630","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the Modula_Meta::add_metas() function being hooked to wp_head on every frontend request and looking up any post via get_post( $_GET['modula_gallery_id'] ) without verifying the gallery's post_status or the requester's capability to read it — the gallery-side input guard is bugged (empty('modula_gallery_id') tests a nonempty string literal instead of the GET parameter, so it is always false), the only object validation is a post_type === 'modula-gallery' check, and no is_user_logged_in()/current_user_can('read_post', $gallery_id) check is performed. This makes it possible for unauthenticated attackers to enumerate private modula-gallery posts and their member attachments and recover the image's title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags emitted in the response, which then allows direct unauthenticated download of the original private image bytes."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpchill","product":"Modula Image Gallery – Photo Grid & Video Gallery","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.0.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:50:17.988203Z","id":"CVE-2026-89406","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/class-modula-meta.php#L142","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/class-modula-meta.php#L26","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/class-modula-meta.php#L50","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/social_meta.php#L8","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3697043%40modula-best-grid-gallery&new=3697043%40modula-best-grid-gallery","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a369dff6-feca-47cf-8511-dc75c4ffdd29?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-89426","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:40.940","lastModified":"2026-09-25T14:17:21.750","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the `maybe_update_user_role()` function reading the target role directly from an attacker-controlled Gravity Forms entry field — configured via the feed's `user_role_field_id` — and passing it to `WP_User::set_role()` without validating the supplied value against an allowlist of permitted roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to administrator by tampering with the hidden role field value at form submission time. Exploitation is further enabled by the fact that $0 orders are synchronously marked as SUCCESS during form submission without requiring a real payment, and when no GF User Registration user can be resolved, the role assignment target falls back to `$lead['created_by']` — the currently authenticated submitter's own user ID — making any authenticated form submitter an eligible exploitation target."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"knitpay","product":"Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"9.6.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:49:41.552995Z","id":"CVE-2026-89426","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.4.0.1/packages/wp-pay-extensions/gravityforms/src/Extension.php#L381","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.4.0.1/packages/wp-pay-extensions/gravityforms/src/Extension.php#L384","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.4.0.1/packages/wp-pay-extensions/gravityforms/src/Extension.php#L989","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.4.0.1/packages/wp-pay-extensions/gravityforms/src/Processor.php#L493","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.6.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L381","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.6.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L384","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.6.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L989","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.6.1.0/packages/wp-pay-extensions/gravityforms/src/Processor.php#L493","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3706862%40knit-pay&new=3706862%40knit-pay","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee5df686-7bf8-42cc-9356-92570bd02355?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-92608","sourceIdentifier":"security@apache.org","published":"2026-09-25T08:16:41.083","lastModified":"2026-10-05T18:19:28.370","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.qpid:qpid-broker-plugins-amqp-msg-conv-0-10-to-1-0","versions":[{"version":"0","lessThanOrEqual":"10.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:35:53.871389Z","id":"CVE-2026-92608","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-248"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:*","versionEndExcluding":"10.1.1","matchCriteriaId":"952FA6B1-8568-468F-B6D2-311F977B2138"}]}]}],"references":[{"url":"https://lists.apache.org/thread/rklst4cz1g0nkpzkpho7kjmy4gnx1ppc","source":"security@apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/16","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-92609","sourceIdentifier":"security@apache.org","published":"2026-09-25T08:16:41.203","lastModified":"2026-10-05T18:08:07.400","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.qpid:qpid-broker-plugins-management-http","versions":[{"version":"0","lessThanOrEqual":"10.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:25:35.738895Z","id":"CVE-2026-92609","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-384"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:*","versionEndExcluding":"10.1.1","matchCriteriaId":"952FA6B1-8568-468F-B6D2-311F977B2138"}]}]}],"references":[{"url":"https://lists.apache.org/thread/93w83oro48cqokb24k8tkogyvtlqhqw6","source":"security@apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/17","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-92713","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:41.310","lastModified":"2026-09-25T14:17:22.480","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_image function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and Authors trivially satisfy the edit_post check on their own galleries."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpchill","product":"Modula Image Gallery – Photo Grid & Video Gallery","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:51:25.309839Z","id":"CVE-2026-92713","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.2/includes/admin/helpers/class-modula-gallery-upload.php#L1310","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.2/includes/admin/helpers/class-modula-gallery-upload.php#L260","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.2/includes/v2/rest/class-gallery-upload-controller.php#L337","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3701804%40modula-best-grid-gallery&new=3701804%40modula-best-grid-gallery","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1686f4ad-b114-4e4f-b8f7-8ea7c31b2672?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93654","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:41.437","lastModified":"2026-09-25T13:08:08.163","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The checkout REST route uses permission_callback set to __return_true and the invoice loader performs no order ownership check, meaning an unauthenticated attacker can both persist the payload and ensure it is renderable to any logged-in user who accesses the invoice."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"codename065","product":"Premium Packages – Sell Digital Products Securely","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T10:31:03.562692Z","id":"CVE-2026-93654","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/includes/libs/cart-functions.php#L483","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/src/Cart/CartItem.php#L96","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/src/Cart/CartService.php#L328","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/src/Order/OrderService.php#L1255","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/templates/invoices/default/invoice.php#L167","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3708519%40wpdm-premium-packages&new=3708519%40wpdm-premium-packages","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38e3a2a4-3d35-4de9-9b44-568eab0c44f6?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93656","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:41.570","lastModified":"2026-09-25T14:17:23.803","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable via a nonce-free GET request to /wp-admin/profile.php, requiring no profile-form submission; a Subscriber can plant the malicious attachment URL, which then executes when an administrator opens that user's Edit User screen."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"cozmoslabs","product":"User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:51:16.336339Z","id":"CVE-2026-93656","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/avatar/avatar.php#L43","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/avatar/avatar.php#L67","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/avatar/avatar.php#L75","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/fields-functions.php#L30","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/upload/upload_helper_functions.php#L286","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3708665/profile-builder","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4991ff-903a-410a-b472-1a5f76a32940?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93747","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:41.707","lastModified":"2026-09-25T14:17:23.930","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profile_update action — the raw $_POST['data'] array is copied into a $custom_fields variable before validate() and sanitize() run, both of which operate only on a parallel $user reference, leaving $custom_fields unsanitized when it is persisted via update_custom_fields(); on render, wpforo_decode() reverses the entity encoding and the value is echoed without escaping in field_wrap_profile(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"tomdever","product":"wpForo Forum","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.1.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:52:02.638885Z","id":"CVE-2026-93747","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Actions.php#L711","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Forms.php#L1074","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Forms.php#L324","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Members.php#L1157","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Members.php#L906","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3706608%40wpforo&new=3706608%40wpforo","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15dc1661-793a-43dd-8a12-8f51da6cb304?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93901","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:41.837","lastModified":"2026-09-25T14:17:24.677","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the `provisionBlogCredentials()` function in `iHomefinderAdmin.php` being reachable via the `wp_ajax_nopriv_ihf_clear_cache` AJAX action — through the call chain `iHomefinderAjaxHandler::clearCache()` → `activateAuthenticationToken()` → `getAuthenticationInfo()` → `provisionBlogCredentials()` — with no capability check, nonce verification, or ownership validation, and the function unconditionally calling `$user->set_role('author')` on whichever WordPress account matches the hard-coded login `optima-express` via `get_user_by('login', 'optima-express')`. This makes it possible for unauthenticated attackers to escalate a pre-registered `optima-express` account to the Author role, gaining `publish_posts`, `upload_files`, and `edit_published_posts` capabilities, including access to the plugin's own `/wp-json/optima-express/v1/blog-post` REST endpoint. Exploitation requires open user registration to be enabled on the target site, and the attacker must register the `optima-express` username before the plugin has had the opportunity to provision that login for its own integration account."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"ihomefinder","product":"Optima Express IDX","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"8.7.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:50:36.846826Z","id":"CVE-2026-93901","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/optima-express/tags/8.7.5/iHomefinder.php#L176","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/optima-express/tags/8.7.5/iHomefinder.php#L291","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/optima-express/tags/8.7.5/iHomefinderAdmin.php#L369","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/optima-express/tags/8.7.5/iHomefinderAdmin.php#L498","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/optima-express/tags/8.7.5/iHomefinderAdmin.php#L752","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/optima-express/tags/8.7.5/iHomefinderAdmin.php#L795","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/optima-express/tags/8.7.5/iHomefinderAdmin.php#L818","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/optima-express/tags/8.7.5/iHomefinderAjaxHandler.php#L146","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3706448%40optima-express&new=3706448%40optima-express","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ba63df6-ae71-4320-bb82-87d6e17cc47d?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-94573","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:42.047","lastModified":"2026-09-25T13:08:08.163","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"addonsorg","product":"Repeater Fields for Elementor Forms","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.2.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T10:28:05.170599Z","id":"CVE-2026-94573","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/repeater-for-elementor/tags/2.2.7/fields/repeater_end.php#L237","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/repeater-for-elementor/tags/2.2.7/fields/repeater_end.php#L309","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/repeater-for-elementor/tags/2.2.7/fields/repeater_end.php#L317","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/repeater-for-elementor/tags/2.2.7/libs/admin.js#L15","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3710785%40repeater-for-elementor&new=3710785%40repeater-for-elementor","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea28fc6c-50d6-406b-9205-3f1bec577644?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-95864","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:42.177","lastModified":"2026-09-25T14:17:25.113","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required to reach the vulnerable endpoint is embedded in plain sight within the front-end page markup for all visitors, reducing the access control to a CSRF token rather than an authentication barrier and making the endpoint fully exploitable by unauthenticated attackers."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"themifyme","product":"Themify Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.8.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:49:15.738448Z","id":"CVE-2026-95864","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.8.1/classes/class-themify-builder-stylesheet.php#L160","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.8.1/classes/class-themify-builder-stylesheet.php#L317","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.8.1/classes/class-themify-builder-stylesheet.php#L514","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.8.1/themify/class-themify-enqueue.php#L1757","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3710320%40themify-builder&new=3710320%40themify-builder","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc021ee6-694a-426b-b399-8dd015fd99d2?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-95866","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:42.307","lastModified":"2026-09-25T14:17:25.227","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The zero-length multipart file branch in wppb_save_avatar_value() writes the raw request value directly to user meta, bypassing the wppb_save_attachment_id()/wppb_verify_attachment_id() validation path; the stored payload is later adopted as a WordPress attachment URL and rendered unescaped by wppb_default_fields_make_upload_button() when an administrator views the affected account."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"cozmoslabs","product":"User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:50:45.923425Z","id":"CVE-2026-95866","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/avatar/avatar.php#L127","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/avatar/avatar.php#L67","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/upload/upload_helper_functions.php#L286","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3708665%40profile-builder&new=3708665%40profile-builder","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68cef86f-3a6a-47c4-a092-de3bb40ac157?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96448","sourceIdentifier":"secalert@redhat.com","published":"2026-09-25T08:16:42.437","lastModified":"2026-09-26T23:16:40.660","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite roles to see what other permissions they contain, an administrator with limited rights can assign a role that secretly includes full administrative control. This allows the attacker to gain complete management access over the entire realm."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.7,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:42:06.218227Z","id":"CVE-2026-96448","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-96448","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539291","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-96568","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:42.567","lastModified":"2026-09-25T14:17:25.457","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"jetmonsters","product":"Restaurant Menu and Food Ordering","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.4.14","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:51:05.531778Z","id":"CVE-2026-96568","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/mp-restaurant-menu/tags/2.4.14/classes/models/shop/class-order.php#L1497","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mp-restaurant-menu/tags/2.4.14/classes/models/shop/class-order.php#L465","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mp-restaurant-menu/tags/2.4.14/classes/models/shop/class-order.php#L725","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mp-restaurant-menu/tags/2.4.14/classes/models/shop/class-order.php#L727","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mp-restaurant-menu/tags/2.4.14/classes/models/shop/class-purchase.php#L494","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3709808%40mp-restaurant-menu&new=3709808%40mp-restaurant-menu","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61322037-ecd0-4db2-997f-9ef943116396?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96752","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T08:16:42.700","lastModified":"2026-09-25T13:08:08.163","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all versions up to, and including, 5.7.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered by submitting a Contact Form 7 request with a nested POST array key containing arbitrary HTML or JavaScript — PHP parses the field name into a nested array key, which is stored verbatim in the zerospam_log.submission_data column when Zero Spam flags the submission as spam due to the absence of the zerospam_david_walsh_key field."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"bmarshall511","product":"Zero Spam for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.7.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T10:33:19.693456Z","id":"CVE-2026-96752","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/zero-spam/tags/5.7.10/core/class-utilities.php#L65","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/zero-spam/tags/5.7.10/includes/class-db.php#L442","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/zero-spam/tags/5.7.10/includes/templates/admin-modal-details.php#L200","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/zero-spam/tags/5.7.10/modules/contactform7/class-contactform7.php#L85","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3709762%40zero-spam&new=3709762%40zero-spam","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01540d78-ae46-4556-9a7f-3f8b8dbbcbd7?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-6082","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-09-25T09:17:05.210","lastModified":"2026-09-25T13:25:16.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/payment-methods' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name’, and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access. Exploiting this vulnerability could allow a remote, previously authenticated attacker to execute arbitrary JavaScript code."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"Novadigits technologies","product":"StockAgile","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"25/09/2026","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:54:45.322195Z","id":"CVE-2026-6082","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-stockagile-novadigits-technologies","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-6083","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-09-25T09:17:05.363","lastModified":"2026-09-25T13:25:16.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '\n/inventory/configuration/pricing-tiers' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name’, and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access. Exploiting this vulnerability could allow a remote, previously authenticated attacker to execute arbitrary JavaScript code."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"Novadigits technologies","product":"StockAgile","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"25/09/2026","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:52:58.855938Z","id":"CVE-2026-6083","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-stockagile-novadigits-technologies","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-6084","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-09-25T09:17:05.487","lastModified":"2026-09-25T13:25:16.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/variants' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name’, and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access. Exploiting this vulnerability could allow a remote, previously authenticated attacker to execute arbitrary JavaScript code."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"Novadigits technologies","product":"StockAgile","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"25/09/2026","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:50:46.846928Z","id":"CVE-2026-6084","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-stockagile-novadigits-technologies","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-6085","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-09-25T09:17:05.610","lastModified":"2026-09-25T13:25:16.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name’, and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access. Exploiting this vulnerability could allow a remote, previously authenticated attacker to execute arbitrary JavaScript code."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"Novadigits technologies","product":"StockAgile","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"25/09/2026","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:48:52.827906Z","id":"CVE-2026-6085","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-stockagile-novadigits-technologies","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-6086","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-09-25T09:17:05.733","lastModified":"2026-09-25T13:25:16.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name’, and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access. Exploiting this vulnerability could allow a remote, previously authenticated attacker to execute arbitrary JavaScript code."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"Novadigits technologies","product":"StockAgile","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"25/09/2026","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:47:31.853047Z","id":"CVE-2026-6086","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-stockagile-novadigits-technologies","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-6087","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-09-25T09:17:05.853","lastModified":"2026-09-25T13:25:16.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name’, and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access. Exploiting this vulnerability could allow a remote, previously authenticated attacker to execute arbitrary JavaScript code."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"Novadigits technologies","product":"StockAgile","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"25/09/2026","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:47:07.588716Z","id":"CVE-2026-6087","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-stockagile-novadigits-technologies","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-6088","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-09-25T09:17:05.973","lastModified":"2026-09-25T13:25:16.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name’, and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access. Exploiting this vulnerability could allow a remote, previously authenticated attacker to execute arbitrary JavaScript code."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"Novadigits technologies","product":"StockAgile","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"25/09/2026","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:45:27.997459Z","id":"CVE-2026-6088","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-stockagile-novadigits-technologies","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-80514","sourceIdentifier":"contact@wpscan.com","published":"2026-09-25T09:17:06.093","lastModified":"2026-09-25T13:25:16.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"wpForo Forum","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"3.0.0","lessThan":"3.1.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:36:40.191225Z","id":"CVE-2026-80514","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-348"}]}],"references":[{"url":"https://wpscan.com/vulnerability/1c08e9ba-b68a-4e77-970f-3dc7c7cd74f9/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86837","sourceIdentifier":"contact@wpscan.com","published":"2026-09-25T09:17:06.210","lastModified":"2026-09-25T13:25:16.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Bookly","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"28.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:36:46.347486Z","id":"CVE-2026-86837","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/5bfed7cf-5bf3-4a3b-a2b6-9f9d48f52fd5/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88848","sourceIdentifier":"contact@wpscan.com","published":"2026-09-25T09:17:06.323","lastModified":"2026-09-25T13:25:16.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid courses outside their plan and beyond the number of courses it entitles them to."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MasterStudy LMS","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"1.9","lessThan":"3.7.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:36:33.646690Z","id":"CVE-2026-88848","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://wpscan.com/vulnerability/13258868-aeed-4664-8b38-ffb1f802895a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-92550","sourceIdentifier":"security@apache.org","published":"2026-09-25T09:17:06.447","lastModified":"2026-10-05T18:19:20.653","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol","packageURL":"pkg:maven/org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol","versions":[{"version":"0","lessThanOrEqual":"10.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:58:01.265450Z","id":"CVE-2026-92550","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-789"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:*","versionEndExcluding":"10.1.1","matchCriteriaId":"952FA6B1-8568-468F-B6D2-311F977B2138"}]}]}],"references":[{"url":"https://lists.apache.org/thread/56w1kxz9h23q364ffyvj7cssdhnld5dq","source":"security@apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/12","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-92560","sourceIdentifier":"security@apache.org","published":"2026-09-25T09:17:06.587","lastModified":"2026-10-05T18:06:34.563","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.qpid:qpid-broker-plugins-amqp-0-10-protocol","packageURL":"pkg:maven/org.apache.qpid/qpid-broker-plugins-amqp-0-10-protocol","versions":[{"version":"0","lessThanOrEqual":"10.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:10:39.137588Z","id":"CVE-2026-92560","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:*","versionEndExcluding":"10.1.1","matchCriteriaId":"952FA6B1-8568-468F-B6D2-311F977B2138"}]}]}],"references":[{"url":"https://lists.apache.org/thread/dcsjw242n1bxdog29hwlg43r5611dtb7","source":"security@apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/13","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-92564","sourceIdentifier":"security@apache.org","published":"2026-09-25T09:17:06.717","lastModified":"2026-10-05T18:04:01.700","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol","versions":[{"version":"0","lessThanOrEqual":"10.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:23:29.728672Z","id":"CVE-2026-92564","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:*","versionEndExcluding":"10.1.1","matchCriteriaId":"952FA6B1-8568-468F-B6D2-311F977B2138"}]}]}],"references":[{"url":"https://lists.apache.org/thread/hw4jkngtkzf0dxdj9mv3z2p71mkpjvx4","source":"security@apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/14","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-92573","sourceIdentifier":"security@apache.org","published":"2026-09-25T09:17:06.837","lastModified":"2026-10-05T18:01:53.607","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.qpid:qpid-broker-core","packageURL":"pkg:maven/org.apache.qpid/qpid-broker-core","versions":[{"version":"0","lessThanOrEqual":"10.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:13:01.234459Z","id":"CVE-2026-92573","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-409"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:*","versionEndExcluding":"10.1.1","matchCriteriaId":"952FA6B1-8568-468F-B6D2-311F977B2138"}]}]}],"references":[{"url":"https://lists.apache.org/thread/461lhqt1r4g1mq3oyrcscphxzlhxlv1y","source":"security@apache.org","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/15","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-97863","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-25T09:17:08.003","lastModified":"2026-09-25T14:31:45.000","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values (IP address, login, password, domain ID, policy ID) and MISP attribute values (destination IPs, URLs, event info comments) directly into single-quoted shell string assignments without any escaping or sanitization. Because the values are placed inside single-quoted shell strings, any value containing a single-quote character (e.g., a crafted ip-dst or url attribute value submitted to MISP) breaks out of the quoting context, allowing an attacker to inject arbitrary shell commands into the exported script. A security analyst who subsequently executes the generated .sh file unmodified would run the injected commands with their own privileges, potentially exposing fireSIGHT Manager credentials, modifying ACL rules, or compromising the analyst workstation. Additionally, the module contained a secondary defect where the variable 'config' was only assigned inside a conditional block but referenced unconditionally afterward, causing a NameError (denial of service) when the request payload lacked a 'config' key. The vulnerability requires the attacker to have the ability to submit MISP events or attributes containing a single-quote character and the victim to execute the exported script. No authentication bypass is required beyond standard MISP event-submission privileges."}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"misp","product":"misp-modules","defaultStatus":"unaffected","collectionURL":"https://github.com/MISP/misp-modules","modules":["cisco_firesight_manager_ACL_rule_export"],"programFiles":["misp_modules/modules/export_mod/cisco_firesight_manager_ACL_rule_export.py"],"repo":"https://github.com/misp/misp-modules","versions":[{"version":"0","lessThanOrEqual":"3.0.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:18:10.409406Z","id":"CVE-2026-97863","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/misp/misp-modules/commit/625b54908efbd6acc8343aa3370d401dd370e748","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-92106","sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","published":"2026-09-25T10:17:08.263","lastModified":"2026-09-25T13:22:04.673","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.\n\nLazyHTML.to_html/2 and LazyHTML.Tree.to_html/2 decide whether to escape an element's text from its tag name alone. A style or script element inside SVG or MathML foreign content is parsed with character references decoded, but is serialized as an HTML raw-text element, so its text is emitted unescaped. Encoded markup such as &lt;/style&gt;&lt;img src=x onerror=...&gt; inside <svg><style> therefore closes the element on re-parse and becomes live markup. Applications that parse untrusted HTML with lazy_html, filter the document or tree, and serialize it for display are affected, since the payload is a plain text node that no element or attribute filter sees.\n\nThis issue affects lazy_html: from 0.1.0 before 0.1.13."}],"affected":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","affectedData":[{"vendor":"dashbitco","product":"lazy_html","defaultStatus":"unaffected","collectionURL":"https://repo.hex.pm","packageName":"lazy_html","cpes":["cpe:2.3:a:dashbitco:lazy_html:*:*:*:*:*:*:*:*"],"modules":["'Elixir.LazyHTML.Tree'","'Elixir.LazyHTML'","'Elixir.LazyHTML.NIF'"],"programFiles":["lib/lazy_html/tree.ex","lib/lazy_html.ex","c_src/lazy_html.cpp"],"programRoutines":[{"name":"'Elixir.LazyHTML.Tree':to_html/2"},{"name":"'Elixir.LazyHTML':to_html/2"},{"name":"is_noescape_text_node"}],"repo":"https://github.com/dashbitco/lazy_html","packageURL":"pkg:hex/lazy_html","versions":[{"version":"0.1.0","lessThan":"0.1.13","versionType":"semver","status":"affected"}]},{"vendor":"dashbitco","product":"lazy_html","defaultStatus":"unaffected","collectionURL":"https://github.com","packageName":"dashbitco/lazy_html","cpes":["cpe:2.3:a:dashbitco:lazy_html:*:*:*:*:*:*:*:*"],"modules":["'Elixir.LazyHTML.Tree'","'Elixir.LazyHTML'","'Elixir.LazyHTML.NIF'"],"programFiles":["lib/lazy_html/tree.ex","lib/lazy_html.ex","c_src/lazy_html.cpp"],"programRoutines":[{"name":"'Elixir.LazyHTML.Tree':to_html/2"},{"name":"'Elixir.LazyHTML':to_html/2"},{"name":"is_noescape_text_node"}],"repo":"https://github.com/dashbitco/lazy_html","packageURL":"pkg:github/dashbitco/lazy_html","versions":[{"version":"1dee15746c024916b3110af8b168c2f3b3065fbd","lessThan":"f32c7fd6223225b68bc8691c78b6d4a77972f1d5","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:35:42.717583Z","id":"CVE-2026-92106","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-92106.html","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/dashbitco/lazy_html/commit/1dee15746c024916b3110af8b168c2f3b3065fbd","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/dashbitco/lazy_html/commit/f32c7fd6223225b68bc8691c78b6d4a77972f1d5","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/dashbitco/lazy_html/security/advisories/GHSA-8rqp-v692-v82q","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-92106","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}]}},{"cve":{"id":"CVE-2026-97898","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-25T10:17:08.907","lastModified":"2026-09-25T14:31:45.000","vulnStatus":"Deferred","cveTags":[{"sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","tags":["exclusively-hosted-service"]}],"descriptions":[{"lang":"en","value":"Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could unlock rooms other than their own, resulting in unauthorized physical access to guest rooms at an affected property.\n\n\n\n\nAs of 19th September 2026 the service is no more vulnerable to this attack (feedback received by the reporter). \n\n\n\n\nThe attack is remote but the effect is local to an affected property."}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"akia","product":"akia","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.10.19","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T12:18:28.132095Z","id":"CVE-2026-97898","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://www.akia.com/platform/keyless-entry","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-27867","sourceIdentifier":"ffb98d57-deaa-4918-a669-5225ccc13e39","published":"2026-09-25T11:17:01.203","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who has the vulnerable firmware version could inject\na specific payload via the parameter \"cmdcookie\" withing the /upgrade/index.html resulting in to a Cross-Site Scripting (XSS). This issue affects Regesta Smart HD-PLC - TLDPH16D2: \n11.02.06.00.02"}],"affected":[{"source":"ffb98d57-deaa-4918-a669-5225ccc13e39","affectedData":[{"vendor":"Teldat","product":"Regesta Smart HD-PLC - TLDPH16D2","defaultStatus":"unknown","versions":[{"version":"11.02.06.00.02","status":"affected"},{"version":"11.02.06.00.03","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ffb98d57-deaa-4918-a669-5225ccc13e39","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T10:42:56.136783Z","id":"CVE-2026-27867","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ffb98d57-deaa-4918-a669-5225ccc13e39","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://support.teldat.com/images/content/docs/Teldat_dm1087_regesta_smart_nessum_series_installation(1).pdf","source":"ffb98d57-deaa-4918-a669-5225ccc13e39"},{"url":"https://support.teldat.com/portal/supportcontent?page=cgs-customer-global-support&none=true&language=en-US","source":"ffb98d57-deaa-4918-a669-5225ccc13e39"},{"url":"https://www.hackrtu.com/blog/CNA-CVE-2026-27867/","source":"ffb98d57-deaa-4918-a669-5225ccc13e39"},{"url":"https://www.hackrtu.com/blog/CNA-HRTU-0004/","source":"ffb98d57-deaa-4918-a669-5225ccc13e39"},{"url":"https://www.teldat.com/es/","source":"ffb98d57-deaa-4918-a669-5225ccc13e39"}]}},{"cve":{"id":"CVE-2026-97228","sourceIdentifier":"cve@rapid7.com","published":"2026-09-25T11:17:02.163","lastModified":"2026-09-25T13:26:09.190","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.py`), whereby the `export_id` value — an unvalidated MCP tool argument reaching the function via the `check_rapid7_export_status` and `download_rapid7_export` tools — is interpolated directly into the GraphQL query string. A crafted `export_id` containing quote and brace characters can terminate the intended `export(id: \"...\")` selection early and append attacker-controlled root-level selections (for example, schema introspection), producing a single well-formed GraphQL document that is then sent to the Rapid7 export API under the operator's own API key.\n\nNotably, this issue does not grant an existing actor any access they do not already have: every injected query executes within the operator's own already-authenticated API scope, using the operator's own valid API key, and cannot cross a tenant or account boundary. A directly-malicious operator gains nothing they could not already do by calling the API directly; the realistic exposure is limited to a compromised or careless upstream MCP client, or indirect prompt injection forwarding an unvalidated identifier. This is fixed in version 0.6.2, which passes `export_id` as a parameterized GraphQL variable (`$exportId: ID!`)."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Rapid7","product":"Platform","defaultStatus":"unaffected","modules":["Rapid7 Bulk Export MCP"],"repo":"http://github.com/rapid7/rapid7-bulk-export-mcp","versions":[{"version":"0","lessThan":"0.6.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T10:53:09.339314Z","id":"CVE-2026-97228","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-943"}]}],"references":[{"url":"https://github.com/rapid7/rapid7-bulk-export-mcp/releases/tag/v0.6.2","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-97522","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:02.297","lastModified":"2026-10-19T10:17:21.023","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix bad accounting in __mptcp_subflow_push_pending()\n\nIf __subflow_push_pending() errors out we should avoid updating the\ncopied byte counters, to avoid mismatch push call later on."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mptcp/protocol.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0fa1b3783a17d75a4aa1651a18ede041ffca5750","lessThan":"ddbf9f03c1cc7d5b86eebe7c2beea0db4286d354","versionType":"git","status":"affected"},{"version":"0fa1b3783a17d75a4aa1651a18ede041ffca5750","lessThan":"9781fa35d9f7a87a83115acd3a88bc9ce35b5407","versionType":"git","status":"affected"},{"version":"0fa1b3783a17d75a4aa1651a18ede041ffca5750","lessThan":"a0a64525f3414268ed4b1945a1dc690aa974dd4f","versionType":"git","status":"affected"},{"version":"0fa1b3783a17d75a4aa1651a18ede041ffca5750","lessThan":"dc054821e639a2e14f1419436612db70b6af45fc","versionType":"git","status":"affected"},{"version":"0fa1b3783a17d75a4aa1651a18ede041ffca5750","lessThan":"f3ef03357396d4b147d8e76c75fb612c2f264ffc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mptcp/protocol.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/9781fa35d9f7a87a83115acd3a88bc9ce35b5407","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0a64525f3414268ed4b1945a1dc690aa974dd4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc054821e639a2e14f1419436612db70b6af45fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ddbf9f03c1cc7d5b86eebe7c2beea0db4286d354","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f3ef03357396d4b147d8e76c75fb612c2f264ffc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97523","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:02.407","lastModified":"2026-10-19T10:17:21.130","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: close race between scheduler and state change\n\nThe mptcp scheduler may race with subflow sockets state change: data\ntransmission on the selected socket may fail and a later release could\ntry to use mss_now reset to 0 for a divide operation.\n\nAddress the issue by explicitly checking for the critical scenario."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mptcp/protocol.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fb9c73ef2ac2ec816efdc8b9267bc04e1369c20b","lessThan":"d74b2e26b54a7dae1d87c1f19ae0d6db500e5e03","versionType":"git","status":"affected"},{"version":"c886d70286bf3ad411eb3d689328a67f7102c6ae","lessThan":"5883ae880f51edc4b1484e787473b865b6159ead","versionType":"git","status":"affected"},{"version":"c886d70286bf3ad411eb3d689328a67f7102c6ae","lessThan":"0a926b5df8efdfbac07e2fb7fafb21849a2ad9c0","versionType":"git","status":"affected"},{"version":"c886d70286bf3ad411eb3d689328a67f7102c6ae","lessThan":"8f11430d51ff8365bc51b670bc3002b65ae4c6b7","versionType":"git","status":"affected"},{"version":"c886d70286bf3ad411eb3d689328a67f7102c6ae","lessThan":"a09c87abf10a0a7e203137c75b5381aa63d9b31d","versionType":"git","status":"affected"},{"version":"c886d70286bf3ad411eb3d689328a67f7102c6ae","lessThan":"4c856f3c151a2f3fa237caa651c44015916ca584","versionType":"git","status":"affected"},{"version":"c886d70286bf3ad411eb3d689328a67f7102c6ae","lessThan":"42064de57fb83231fcc89663a94885f228a1ee53","versionType":"git","status":"affected"},{"version":"8caf5c15b5288d52d9c89374d6c10fa32ee84ec5","versionType":"git","status":"affected"},{"version":"5.15.190","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"5.19.4","lessThan":"5.20","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mptcp/protocol.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/0a926b5df8efdfbac07e2fb7fafb21849a2ad9c0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42064de57fb83231fcc89663a94885f228a1ee53","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c856f3c151a2f3fa237caa651c44015916ca584","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5883ae880f51edc4b1484e787473b865b6159ead","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f11430d51ff8365bc51b670bc3002b65ae4c6b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a09c87abf10a0a7e203137c75b5381aa63d9b31d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d74b2e26b54a7dae1d87c1f19ae0d6db500e5e03","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97524","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:02.520","lastModified":"2026-10-19T10:17:21.260","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: avoid unneeded actions on subflow reset\n\nOnce in a blue moon, the mptcp receive path can recursively call\nmptcp_data_ready() via state change under unlucky error conditions, and\nthen try to hold the data lock again.\n\nBreak the recursion loop explicitly checking for the exceptional\ncondition.\n\nAdd a new flag instead of using an existing one like 'closing', to exit\nearly in subflow_state_change(), and explicitly flush the RX queue at\nreset time.\n\nThis avoids unneeded processing to check for available data -- calling\nget_mapping_status() and more on a dying subflow -- but also in error\nreporting and worker scheduling.\n\nNote that we must consume the currently peeked skb before invoking\nmptcp_dss_corruption to avoid consuming it again after the eventual\nreset has freed it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mptcp/protocol.c","net/mptcp/protocol.h","net/mptcp/subflow.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fde99e972b8f88cebe619241d7aa43d288ef666a","lessThan":"6d669c740933124eae3df8cfc15995af9bcc6aba","versionType":"git","status":"affected"},{"version":"12c1676d598e3b8dd92a033b623b792cc2ea1ec5","lessThan":"83a7dcdd2b1060484528da70a643125174d47e5a","versionType":"git","status":"affected"},{"version":"35668f8ec84f6c944676e48ecc6bbc5fc8e6fe25","lessThan":"a370e56024df0b07e3120c45a9773ae123819fd6","versionType":"git","status":"affected"},{"version":"b8be15d1ae7ea4eedd547c3b3141f592fbddcd30","lessThan":"1962841387087970d75ba8b8d4c2aa2d45705e50","versionType":"git","status":"affected"},{"version":"e32d262c89e2b22cb0640223f953b548617ed8a6","lessThan":"4b7abdcb5ba832fafab679f0d998af39cbc99307","versionType":"git","status":"affected"},{"version":"e32d262c89e2b22cb0640223f953b548617ed8a6","lessThan":"b2dbcc1ed48b5ac070a41db4a52aade6823c4df0","versionType":"git","status":"affected"},{"version":"e32d262c89e2b22cb0640223f953b548617ed8a6","lessThan":"ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f","versionType":"git","status":"affected"},{"version":"e32d262c89e2b22cb0640223f953b548617ed8a6","lessThan":"2b0f561f21b27c40c91ea4975268a06092bd7e9c","versionType":"git","status":"affected"},{"version":"8bfd391bde685df7289b928ce8876a3583be4bfb","versionType":"git","status":"affected"},{"version":"5.10.228","lessThan":"5.10.271","versionType":"semver","status":"affected"},{"version":"5.15.169","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"6.1.113","lessThan":"6.1.189","versionType":"semver","status":"affected"},{"version":"6.6.57","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.11.4","lessThan":"6.12","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mptcp/protocol.c","net/mptcp/protocol.h","net/mptcp/subflow.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/1962841387087970d75ba8b8d4c2aa2d45705e50","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2b0f561f21b27c40c91ea4975268a06092bd7e9c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4b7abdcb5ba832fafab679f0d998af39cbc99307","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d669c740933124eae3df8cfc15995af9bcc6aba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83a7dcdd2b1060484528da70a643125174d47e5a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a370e56024df0b07e3120c45a9773ae123819fd6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2dbcc1ed48b5ac070a41db4a52aade6823c4df0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97525","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:02.647","lastModified":"2026-10-19T10:17:21.410","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Allocate split page tables as kernel page tables\n\nA PTE is allocated directly without going through the standard page table\nallocation routines (such as pte_alloc_one_kernel()) when the CPA code\nsplits a large page (__split_large_page()).\n\nThis means the page table constructor is never called nor is the page table\nmarked as a kernel page table.\n\nThe former results in the folio associated with the page table not being\nmarked as a page table (__pagetable_ctor() is never called thus neither is\n__folio_set_pgtable()) nor are statistics updated to reflect\nit (lruvec_stat_add_folio() is never called).\n\nThe latter issue of failing to mark the page table as a kernel page\ntable (ptdesc_set_kernel() is never called) is far more problematic.\n\nSince commit:\n\n  5ba2f0a15564 (\"mm: introduce deferred freeing for kernel page tables\")\n\nkernel page table freeing has been batched and since the\nsubsequent commit:\n\n  e37d5a2d60a3 (\"iommu/sva: invalidate stale IOTLB entries for kernel address space\")\n\nIOTLB cache entries for kernel page tables have been invalidated upon\nbeing freed.\n\nSince split page tables are freed without this invalidation, the IOTLB\ncan contain stale entries for them.\n\nResolve the issue by using the ordinary PTE allocation API at split time.\n\nThis results in these kernel page tables invoking a page table constructor,\nand thus requires a page table destructor.\n\nDestructors are not always present, like for early allocated direct map\npage tables). Conditionally call pagetable_dtor_free() if the PG_table\nfolio flag for the ptdesc is set, otherwise we free the page table via\npagetable_free().\n\nRegardless of which path is taken page tables marked as kernel page tables,\nwhich now includes split page tables, take the correct route through\npagetable_free_kernel().\n\nThere is a user-visible side effect in that split page tables will appear\nin nr_page_table_pages in /proc/vmstat (as do other kernel page tables\nallocated after early boot), however this is a positive change.\n\nThis issue started being markedly problematic after commit:\n\n  5ba2f0a15564 (\"mm: introduce deferred freeing for kernel page tables\")\n\nso choose this as the Fixes target.\n\n[ dhansen: rephrase in imperative mood ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/mm/pat/set_memory.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b3039c526f3e1744db0cbb7ae1f0213f5e27d3f4","lessThan":"84e0cd79d57f06b872154eb5d8f610584133f260","versionType":"git","status":"affected"},{"version":"5ba2f0a1556479638ac11a3c201421f5515e89f5","lessThan":"922873cf4fc34124215070a8ad391bf831538bb9","versionType":"git","status":"affected"},{"version":"5ba2f0a1556479638ac11a3c201421f5515e89f5","lessThan":"9e4a3ec3411bb6bb59e3c1f29b75609f1e87aac4","versionType":"git","status":"affected"},{"version":"6.18.7","lessThan":"6.18.53","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/mm/pat/set_memory.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/84e0cd79d57f06b872154eb5d8f610584133f260","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/922873cf4fc34124215070a8ad391bf831538bb9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e4a3ec3411bb6bb59e3c1f29b75609f1e87aac4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97526","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:02.767","lastModified":"2026-10-19T10:17:21.543","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pai: Support CPU hotplug for PMU PAI\n\nThe command 'perf stat -e pai_crypto/CRYPTO_ALL/ -- <command>'\ncrashes the kernel when CPUs are hotplug added during that run.\n\nRoot cause is the missing allocation of per-CPU data structures\nfor that new CPU. The allocation is dynamic and the first\nevent that has task context creates such a structure for\neach online CPU. This is not sufficient. CPUs may be offline\nduring event creation and can be set online during the\nperf run time. For example commands\n\n # echo 0 > /sys/devices/system/cpu/cpu1/online\n # perf stat -e cycles -i -- stress-ng -t10s --matrix X\n # sleep 1\n # echo 1 > /sys/devices/system/cpu/cpu1/online\n\nCurrently without a CPU hotplug handler, that new CPU has no\nper-CPU data infrastructure. The scheduler runs PMU call back\nfunction pai_add() to install the PMU support for that CPU before\nthe task is being scheduled on that new CPU.\nIn pai_add() instructions\n\n    mp = this_cpu_ptr(pai_root[idx].mapptr);\n    cpump = mp->mapptr;\n\nreturn a NULL pointer and the result is a kernel panic as variable\ncpump is used inside that function.\n\nAdd CPU hotplug support for CPU add and delete and create\nthe necessary per-CPU data infrastructure during CPU hotplug\nadd processing. Same for CPU hotplug remove.\nThis is done when the CPU is offline to ensure the data structures\nare available when CPU is made online and tasks are scheduled on it.\n\n[hca@linux.ibm.com: fixup error path in pai_init()]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/s390/include/asm/pai.h","arch/s390/kernel/perf_pai.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9f66572f2889a5e72a9d7e17787e52f03b1f7bd8","lessThan":"706e2bf330144995d123dccf32aaf1981ce5abc2","versionType":"git","status":"affected"},{"version":"9f66572f2889a5e72a9d7e17787e52f03b1f7bd8","lessThan":"9ecc4d033879f7761f2df07e20cd2fbec00fd90b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/s390/include/asm/pai.h","arch/s390/kernel/perf_pai.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/706e2bf330144995d123dccf32aaf1981ce5abc2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9ecc4d033879f7761f2df07e20cd2fbec00fd90b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97527","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:02.873","lastModified":"2026-10-21T13:21:11.907","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock\n\nThe fcport->unsol_ctx_head list is modified from several contexts without\na common lock. Entries are added in qla2xxx_process_purls_iocb() from the\nresponse queue ISR (under the qpair qp_lock), while they are removed from\nqla2xxx_process_purls_pkt() (DPC/purex worker), qla_nvme_xmt_ls_rsp()\n(NVMe-FC transport callback) and qla_nvme_release_lsrsp_cmd_kref() (SRB\ncompletion). The qpair qp_lock cannot serialize this per-fcport list since\nmultiqueue adapters add entries through different qpairs, so a concurrent\nadd and delete (or two concurrent deletes) can corrupt the list pointers.\n\nIntroduce a dedicated per-fcport spinlock, unsol_ctx_lock, initialized in\nqla2x00_alloc_fcport(), and take it around every list_add_tail()/list_del()\non unsol_ctx_head. The add nests under the existing qp_lock; no delete path\ntakes qp_lock, so the lock order is consistent and deadlock free."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/qla2xxx/qla_def.h","drivers/scsi/qla2xxx/qla_init.c","drivers/scsi/qla2xxx/qla_nvme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"875386b98857822b77ac7f95bdf367b70af5b78c","lessThan":"6c71726cdfda93ae169a75c7b1697eb870303125","versionType":"git","status":"affected"},{"version":"875386b98857822b77ac7f95bdf367b70af5b78c","lessThan":"c1ee12eecbab9674fb73c9e00a93fac655d5a5dc","versionType":"git","status":"affected"},{"version":"875386b98857822b77ac7f95bdf367b70af5b78c","lessThan":"b211d138cad86f749826d6132db6388eded992d8","versionType":"git","status":"affected"},{"version":"875386b98857822b77ac7f95bdf367b70af5b78c","lessThan":"4d8ad6bc8cc5eff1870cef00a0d611f38f8b6bd0","versionType":"git","status":"affected"},{"version":"875386b98857822b77ac7f95bdf367b70af5b78c","lessThan":"76da0c43c63eb0496649e372ac64466364d0fe7d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/qla2xxx/qla_def.h","drivers/scsi/qla2xxx/qla_init.c","drivers/scsi/qla2xxx/qla_nvme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/4d8ad6bc8cc5eff1870cef00a0d611f38f8b6bd0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6c71726cdfda93ae169a75c7b1697eb870303125","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/76da0c43c63eb0496649e372ac64466364d0fe7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b211d138cad86f749826d6132db6388eded992d8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c1ee12eecbab9674fb73c9e00a93fac655d5a5dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97528","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:02.980","lastModified":"2026-10-21T13:21:12.063","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error\n\nqla_nvme_xmt_ls_rsp() obtains uctx, which was linked into\nfcport->unsol_ctx_head by qla2xxx_process_purls_iocb() and is still linked\nwhen the NVMe transport calls back to transmit the LS response. On the\nerror (out:) path the function frees uctx with kfree() but never removes\nit from the list. This leaves a freed node in fcport->unsol_ctx_head: the\nnext list_add_tail() for that fcport writes through the freed node, and a\nsubsequent list_del() can corrupt the list or panic.\n\nUnlink uctx with list_del() before kfree() on the error path, matching the\nother free sites in qla_nvme_release_lsrsp_cmd_kref() and\nqla2xxx_process_purls_pkt(). qla2x00_rel_sp() in the failure path only\nreturns the SRB to its pool and does not invoke sp->put_fn, so the out:\npath is the sole free and uctx is always still linked there."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/qla2xxx/qla_nvme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"875386b98857822b77ac7f95bdf367b70af5b78c","lessThan":"925a9129a514b7c3bc0a8af01e51868adbb9a83e","versionType":"git","status":"affected"},{"version":"875386b98857822b77ac7f95bdf367b70af5b78c","lessThan":"cbbf1484496aac86038e67ac984949af58009d4b","versionType":"git","status":"affected"},{"version":"875386b98857822b77ac7f95bdf367b70af5b78c","lessThan":"a95fc5f1c12bba1dbff72bd2611e7fad0758831b","versionType":"git","status":"affected"},{"version":"875386b98857822b77ac7f95bdf367b70af5b78c","lessThan":"c55d649a6cc246c3ccd5d118faea230c46b60f35","versionType":"git","status":"affected"},{"version":"875386b98857822b77ac7f95bdf367b70af5b78c","lessThan":"e46160a5d4fa59bf4d5f3412b6b5cb79edb967dd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/qla2xxx/qla_nvme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/925a9129a514b7c3bc0a8af01e51868adbb9a83e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a95fc5f1c12bba1dbff72bd2611e7fad0758831b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c55d649a6cc246c3ccd5d118faea230c46b60f35","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cbbf1484496aac86038e67ac984949af58009d4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e46160a5d4fa59bf4d5f3412b6b5cb79edb967dd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97529","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:03.087","lastModified":"2026-10-21T13:21:12.223","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]\n\nThe FC BSG transport allocates job->request via memdup_user() using the\nexact user-supplied request_len. For FC_BSG_HST_VENDOR,\nfc_bsg_host_dispatch() only guarantees request_len covers msgcode and\nvendor_id; it does not account for the vendor_cmd[] flexible array.\n\nqla2xxx then reads the command selector vendor_cmd[0] and, in several\nsub-handlers, vendor_cmd[1]/[2] or structures overlaid on the vendor\ncommand area without verifying request_len. A caller holding\nCAP_SYS_RAWIO can submit a short request whose vendor_id matches the\nhost, triggering out-of-bounds heap reads (KASAN-detectable, and able to\nmis-select a command or panic).\n\nAdd a central guard in qla2x00_process_vendor_specific() so the selector\nis always in bounds, restrict the early vendor_cmd[0] read in\nqla24xx_bsg_request() to sufficiently long vendor messages, and add\nrequest_len checks to the sub-handlers that read further:\nqla24xx_proc_fcp_prio_cfg_cmd(), qla2x00_process_loopback(),\nqla84xx_reset(), qla84xx_updatefw(), qla2x00_read_optrom(),\nqla2x00_update_optrom(), qlafx00_mgmt_cmd() and\nqla28xx_validate_flash_image()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/qla2xxx/qla_bsg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"01e0e15c8b3b32e006e5cccac10c8b377ac3d803","lessThan":"5f33efe04658968b6b3f432f904d5f1f74c12286","versionType":"git","status":"affected"},{"version":"01e0e15c8b3b32e006e5cccac10c8b377ac3d803","lessThan":"ef63922d8bdea03de1804af39a6b12212acb1be2","versionType":"git","status":"affected"},{"version":"01e0e15c8b3b32e006e5cccac10c8b377ac3d803","lessThan":"740f3458a4798af54aaf8cf63e797d407e8b6d3b","versionType":"git","status":"affected"},{"version":"01e0e15c8b3b32e006e5cccac10c8b377ac3d803","lessThan":"f75bff451a2fac5aed82f9641df1e9a42c5a899d","versionType":"git","status":"affected"},{"version":"01e0e15c8b3b32e006e5cccac10c8b377ac3d803","lessThan":"4cf38dd9465736141263ebb63375868311a0ec81","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/qla2xxx/qla_bsg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.10","status":"affected"},{"version":"0","lessThan":"4.10","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4cf38dd9465736141263ebb63375868311a0ec81","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5f33efe04658968b6b3f432f904d5f1f74c12286","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/740f3458a4798af54aaf8cf63e797d407e8b6d3b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ef63922d8bdea03de1804af39a6b12212acb1be2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f75bff451a2fac5aed82f9641df1e9a42c5a899d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97530","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:03.200","lastModified":"2026-10-21T13:21:12.347","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix soft lockup polling continuation IOCB signature\n\nqla27xx_copy_multiple_pkt() and qla27xx_copy_fpin_pkt() poll\nrsp_q->ring_ptr->signature for RESPONSE_PROCESSED (0xDEADDEAD) to decide\nwhether the next continuation IOCB has arrived, spinning on cpu_relax()\nwithout advancing the ring or decrementing the entry count while it has\nnot. response_t::signature lives at byte offset 60, but a continuation\nIOCB (sts_cont_entry_t / struct sts_cont_entry_ext) carries raw FC frame\npayload at that offset (data[56..59]). A received frame whose payload\nbytes happen to equal 0xDEADDEAD is therefore misread as \"not yet\narrived\", and the loop spins forever in interrupt/DPC context, causing a\nCPU soft lockup.\n\nThe poll is also unnecessary: callers of qla27xx_copy_multiple_pkt()\n(PT_LS4_UNSOL and the NVMe purls path) already gate on\nqla_chk_cont_iocb_avail(), which guarantees all entry_count IOCBs are\npresent before copying begins. The sibling helper\n__qla_copy_purex_to_buffer() already drops the signature poll and relies\non the entry_type == STATUS_CONT_TYPE guard instead.\n\nRemove the signature busy-wait from both helpers, keeping the entry_type\nguard, and gate the FPIN path with qla_chk_cont_iocb_avail() so it defers\nand re-processes on the next interrupt once all continuation IOCBs have\narrived, mirroring the ELS_AUTH_ELS and PT_LS4_UNSOL arms. With this the\nsignature field is never read on a continuation IOCB, eliminating the\npayload-aliasing lockup."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/qla2xxx/qla_isr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9f2475fe7406b8ef5f97099c4980021344872d9f","lessThan":"428e244dd4066abd40ca1ec525b7aab9a9db8296","versionType":"git","status":"affected"},{"version":"9f2475fe7406b8ef5f97099c4980021344872d9f","lessThan":"3e58eb888ebf265af937f636d05997c60d2f197c","versionType":"git","status":"affected"},{"version":"9f2475fe7406b8ef5f97099c4980021344872d9f","lessThan":"6e6c2ba9022eb8f9b062c81bdc6fd24c7b4c4c16","versionType":"git","status":"affected"},{"version":"9f2475fe7406b8ef5f97099c4980021344872d9f","lessThan":"6aa722fca9d2aa1f64094101587f8f4a2f83f6aa","versionType":"git","status":"affected"},{"version":"9f2475fe7406b8ef5f97099c4980021344872d9f","lessThan":"d7e3fa7d06bf7fcaac186d3c4d635caac166d36c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/qla2xxx/qla_isr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.9","status":"affected"},{"version":"0","lessThan":"5.9","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3e58eb888ebf265af937f636d05997c60d2f197c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/428e244dd4066abd40ca1ec525b7aab9a9db8296","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6aa722fca9d2aa1f64094101587f8f4a2f83f6aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e6c2ba9022eb8f9b062c81bdc6fd24c7b4c4c16","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7e3fa7d06bf7fcaac186d3c4d635caac166d36c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97531","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:03.307","lastModified":"2026-10-21T13:21:12.477","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Skip vport under deletion in report ID acquisition\n\nqla24xx_report_id_acquisition() format-1 handling walks ha->vp_list under\nvport_slock, takes a vref_count on the matching vport and calls\nqla_update_host_map() to register its port id.\n\nA vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then\nqla24xx_disable_vp() removes the vport from the host_map btree and zeroes\nvha->d_id (RESET_AL_PA). The vport is only unlinked from vp_list later,\nin qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX)\nbut does not touch host_map. In the window in between, report ID\nacquisition can still find the vport on vp_list and call\nqla_update_host_map(); with d_id already zeroed it takes the\nbtree_insert32() path and re-inserts the dying vport into host_map.\nNothing cleans that entry afterwards, so once scsi_host_put() frees the\nvha a later host_map lookup dereferences freed memory.\n\nSkip a vport that has VPORT_DELETE set before taking the reference, so it\nis neither re-registered nor scheduled for DPC re-registration. This\nmirrors the existing guard in qla2x00_alert_all_vps()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/qla2xxx/qla_mbx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"41dc529a4602ac737020f423f84686a81de38e6d","lessThan":"40dcd4a71a52414b47fbba2f956387f1077c6c15","versionType":"git","status":"affected"},{"version":"41dc529a4602ac737020f423f84686a81de38e6d","lessThan":"20bb54601d2655e83795b73499c89f6b1cb31016","versionType":"git","status":"affected"},{"version":"41dc529a4602ac737020f423f84686a81de38e6d","lessThan":"d61e8de98c5a52978fb1edd95fe4dde3131b280e","versionType":"git","status":"affected"},{"version":"41dc529a4602ac737020f423f84686a81de38e6d","lessThan":"7a83979d92782f83c90888ebe19bdc9420521940","versionType":"git","status":"affected"},{"version":"41dc529a4602ac737020f423f84686a81de38e6d","lessThan":"23582731afa35031c94fadb71a4f3b4afd094649","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/qla2xxx/qla_mbx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.11","status":"affected"},{"version":"0","lessThan":"4.11","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/20bb54601d2655e83795b73499c89f6b1cb31016","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/23582731afa35031c94fadb71a4f3b4afd094649","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/40dcd4a71a52414b47fbba2f956387f1077c6c15","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a83979d92782f83c90888ebe19bdc9420521940","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d61e8de98c5a52978fb1edd95fe4dde3131b280e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97532","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:03.413","lastModified":"2026-10-21T13:21:12.623","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path\n\nWhen qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to\nprobe_hw_failed and calls qla2x00_mem_free(). Several error labels in\nqla2x00_mem_alloc() freed adapter members (elsrej.c, purex_dma_pool,\nflt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, npiv_info)\nbut left the pointers dangling. qla2x00_mem_free() then freed them a\nsecond time. Worse, for the dma_pool members it issued\ndma_pool_free(ha->s_dma_pool, ...) after s_dma_pool had already been\ndestroyed and set to NULL at fail_s_dma_pool, dereferencing a NULL pool.\n\nClear each freed pointer (and its DMA handle) in the error labels so the\nsubsequent qla2x00_mem_free() skips them."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/qla2xxx/qla_os.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d64d6c5671db5e693a0caaee79f2571b098749c9","lessThan":"5e0d6ffabbbd86b3fb9168b9dbb62190ecb20d84","versionType":"git","status":"affected"},{"version":"d64d6c5671db5e693a0caaee79f2571b098749c9","lessThan":"84f5de696b8c924aeb4bf430a0bdc762fc50e99f","versionType":"git","status":"affected"},{"version":"d64d6c5671db5e693a0caaee79f2571b098749c9","lessThan":"a57570229edb7a0990d5c8067daeb9ac8858a961","versionType":"git","status":"affected"},{"version":"d64d6c5671db5e693a0caaee79f2571b098749c9","lessThan":"286d9594a022dd7e0caa3de9daa63b896bc70d43","versionType":"git","status":"affected"},{"version":"d64d6c5671db5e693a0caaee79f2571b098749c9","lessThan":"6d90f0feb929f6c0f3010f9af4747c7230b75993","versionType":"git","status":"affected"},{"version":"8540351ee8a4d540b1b7ee64b88d5e42c7c0bfbc","versionType":"git","status":"affected"},{"version":"7142b10b87d5b393a0688358b16a4b1d3680ec7d","versionType":"git","status":"affected"},{"version":"4.14.27","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.15.10","lessThan":"4.16","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/qla2xxx/qla_os.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/286d9594a022dd7e0caa3de9daa63b896bc70d43","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5e0d6ffabbbd86b3fb9168b9dbb62190ecb20d84","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d90f0feb929f6c0f3010f9af4747c7230b75993","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/84f5de696b8c924aeb4bf430a0bdc762fc50e99f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a57570229edb7a0990d5c8067daeb9ac8858a961","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97533","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:03.520","lastModified":"2026-10-19T10:17:22.327","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF\n\nA previous commit protected against races between ptdump and CPA collapse,\nhowever one still exists between attribute changes and collapse as reported\nby Denis V. Lunev (linked).\n\nWhen an attribute change arises, a lockless page table walker obtains a PTE\nentry, which is later written to via set_pte_atomic():\n\n  ...\n  -> change_page_attr_set_clr()\n  -> __change_page_attr_set_clr()\n  -> __change_page_attr()\n\t-> _lookup_address_cpa()\n\t-> lookup_address_in_pgd_attr()\n\t-> [ lockless page table walker ]\n  -> set_pte_atomic()\n\nThere is nothing preventing a concurrent CPA collapse which can free the\nPTE that was retrieved here, resulting in a use-after-free.\n\nWith the mmap write lock taken on init_mm over CPA collapse, resolve this\nrace by acquiring an mmap read lock on init_mm over\n__change_page_attr_set_clr().\n\nThis locks across the whole operation over which the walk and the PTE\nentry write occurs, solving the race.\n\nIt is safe to do this here, as no spinlocks are held upon entry to\n__change_page_attr_set_clr().\n\nHowever, the lock must not be held over an allocation, as allocation can\ntrigger reclaim and shrinkers may call into CPA recursively, making\ndeadlocks possible (init_mm -> ... -> fs_reclaim -> init_mm).\n\nA page table is allocated when a huge page needs to be split:\n\n  -> change_page_attr_set_clr()\n  -> __change_page_attr_set_clr()\n  -> __change_page_attr()\n  -> split_large_page()\n  [ pagetable_alloc() ]\n  -> __split_large_page()\n\nAvoid deadlocks by dropping the mmap lock across pagetable_alloc() in\nsplit_large_page() and track whether this is needed by adding a new\n'init_mm_read_locked' flag to struct cpa_data.\n\nThis is safe as __split_large_page() (called with locks re-established)\nrevalidates that the page table entry is the same as it was prior to the\nlocks being dropped and __change_page_attr() repeats the entire page table\nwalk whenever a split occurs, so concurrent split and collapse are\naccounted for.\n\nConcurrent ptdump is also safe as the lock is only dropped over page table\nallocation during which time the page table has not yet been modified.\n\nThe CPA_COLLAPSE flag is only set by set_memory_rox(), which exclusively\noperates upon vmalloc ranges, and on x86 only within the module mapping\nspace.\n\nThis is important, because some callers directly invoke\n__change_page_attr_set_clr(), bypassing this lock. However, none of these\noperate within the module mapping space.\n\n  * cpa_process_alias() - a recursive helper called by\n    __change_page_attr_set_clr().\n  * __set_memory_enc_pgtable() - operates on the direct mapping and (via\n    __vmbus_establish_gpadl()) the vmalloc mapping space.\n  * __set_pages_[n]p() - called by set_direct_map_[invalid, default,\n    valid]_noflush(), __kernel_map_pages() - operates on the direct map.\n  * kernel_[un]map_pages_in_pgd() - operates on EFI ranges.\n\nThis work is based upon Denis V. Lunev's excellent analysis of the bug\nwith gratitude.\n\n[ dhansen: move to imperative voice in changelog ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/mm/pat/set_memory.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"41d88484c71cd4f659348da41b7b5b3dbd3be1f6","lessThan":"e21a9ea81426a85fdb0cdcfcc99d5d9c16b402ab","versionType":"git","status":"affected"},{"version":"41d88484c71cd4f659348da41b7b5b3dbd3be1f6","lessThan":"cc73b2043d106b467accd38e9b1fc09e0607c056","versionType":"git","status":"affected"},{"version":"41d88484c71cd4f659348da41b7b5b3dbd3be1f6","lessThan":"d5d8b8662e6e5a565b47a0388640e88402f23274","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/mm/pat/set_memory.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/cc73b2043d106b467accd38e9b1fc09e0607c056","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5d8b8662e6e5a565b47a0388640e88402f23274","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e21a9ea81426a85fdb0cdcfcc99d5d9c16b402ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97534","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:03.643","lastModified":"2026-10-21T13:21:12.750","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: accurately adjust free_sections during free_segment_range\n\nIn free_segment_range(), MAIN_SECS(sbi) is temporarily reduced by `secs`\nto restrict block allocation to the safe remaining main area while valid\nblocks in the truncated range are evacuated by GC.\n\nHowever, FREE_I(sbi)->free_sections tracks the total number of free\nsections across the whole filesystem. If any sections within the\ntruncated range were already free upon entering free_segment_range(),\nfailing to deduct them from free_sections causes the filesystem to\noverestimate available free sections in the active, reduced main area.\nThis leads to inconsistent free section accounting during GC data\nmigration and can trigger unexpected allocation failures or assertion\nerrors when space is tight.\n\nFix this by calculating the number of already-free sections in the\ntruncated range, deducting them from free_sections upon entering\nfree_segment_range(), and restoring them on exit."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/f2fs/gc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b4b10061ef98c583bcf82a4200703fbaa98c18dc","lessThan":"64a7ed42e9766886dd7300597d90366dfb7a1e53","versionType":"git","status":"affected"},{"version":"b4b10061ef98c583bcf82a4200703fbaa98c18dc","lessThan":"faeb0a20bdd113311519b598dcc075af3b6fb366","versionType":"git","status":"affected"},{"version":"b4b10061ef98c583bcf82a4200703fbaa98c18dc","lessThan":"ca31116fad0954c61a0d38163cc51c48e4981b75","versionType":"git","status":"affected"},{"version":"b4b10061ef98c583bcf82a4200703fbaa98c18dc","lessThan":"8a123a10770d2132d046748f20f02baa8d5539a1","versionType":"git","status":"affected"},{"version":"b4b10061ef98c583bcf82a4200703fbaa98c18dc","lessThan":"8c963d1738fdca400082ff5f9d99e083de4f4e70","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/f2fs/gc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/64a7ed42e9766886dd7300597d90366dfb7a1e53","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8a123a10770d2132d046748f20f02baa8d5539a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c963d1738fdca400082ff5f9d99e083de4f4e70","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ca31116fad0954c61a0d38163cc51c48e4981b75","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/faeb0a20bdd113311519b598dcc075af3b6fb366","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97535","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:03.757","lastModified":"2026-10-21T13:21:12.860","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size\n\nThe VP control IOCB selects its target virtual port by setting one bit\nin vp_idx_map, a fixed 16-byte (128-bit) array in both\nvp_ctrl_entry_24xx and vp_ctrl_entry_24xx_ext. qla25xx_ctrlvp_iocb()\ncomputes map = (vp_index - 1) / 8 and writes vce->vp_idx_map[map]\nwithout checking that map stays within the array.\n\nmax_npiv_vports is taken from firmware and only sanitized to a\nMIN_MULTI_ID_FABRIC-aligned boundary, so it can legitimately be 191 or\n255, and qla24xx_control_vp() only rejects vp_index >= max_npiv_vports.\nA vp_index above 128 therefore yields map >= 16 and an out-of-bounds\nwrite of up to 16 bytes past vp_idx_map, corrupting the trailing IOCB\nfields (or the adjacent request-ring slot on the 64-byte layout).\n\nReject a vp_index that cannot be represented in the IOCB bitmap in\nqla24xx_control_vp(), and add a defensive ARRAY_SIZE() guard in\nqla25xx_ctrlvp_iocb() before the write. Adapters that report the usual\n63 or 127 NPIV vports are unaffected."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/qla2xxx/qla_iocb.c","drivers/scsi/qla2xxx/qla_mid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2853192e154b813fe34a6cbee5e34dfef50d29d0","lessThan":"674d783f2e80d0d7c1c86bf36dc0a09033e704de","versionType":"git","status":"affected"},{"version":"2853192e154b813fe34a6cbee5e34dfef50d29d0","lessThan":"c80a0362a0fe548c15a0324b1f61c04b62bb2174","versionType":"git","status":"affected"},{"version":"2853192e154b813fe34a6cbee5e34dfef50d29d0","lessThan":"48a44e19746eaa70320a3c2571dcb345192fca72","versionType":"git","status":"affected"},{"version":"2853192e154b813fe34a6cbee5e34dfef50d29d0","lessThan":"13354ad251ab009102597a791bc7c4d2265229e1","versionType":"git","status":"affected"},{"version":"2853192e154b813fe34a6cbee5e34dfef50d29d0","lessThan":"878613ecb5a36db26859c4fd83daf9283a334fa2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/qla2xxx/qla_iocb.c","drivers/scsi/qla2xxx/qla_mid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/13354ad251ab009102597a791bc7c4d2265229e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/48a44e19746eaa70320a3c2571dcb345192fca72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/674d783f2e80d0d7c1c86bf36dc0a09033e704de","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/878613ecb5a36db26859c4fd83daf9283a334fa2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c80a0362a0fe548c15a0324b1f61c04b62bb2174","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97536","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:03.863","lastModified":"2026-10-21T13:21:12.997","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix use-after-free of qpair work on queue teardown\n\nThe response queue MSI-X handler qla2xxx_msix_rsp_q() schedules\nqla_do_work() via queue_work(ha->wq, &qpair->q_work). qla_do_work()\ndereferences the qpair (vha, rsp) and takes qpair->qp_lock.\n\nDuring teardown, qla2xxx_delete_qpair() deletes the response queue, which\ncalls free_irq() in qla25xx_free_rsp_que(), and then frees the queue and\nthe qpair. free_irq() waits for running hardirq handlers but does not\ncancel work already placed on ha->wq. A still-pending q_work then runs\nqla_do_work() against the freed qpair and response queue, causing a\nuse-after-free. This is especially likely during full adapter teardown,\nwhere destroy_workqueue(ha->wq) forces pending work to run after the queue\npairs have been freed.\n\nFlush the work item with cancel_work_sync() in qla25xx_free_rsp_que()\nafter free_irq() has released the interrupt (so no new work can be\nqueued) and before the response queue and qpair memory are freed (so the\nflushed handler still sees valid memory). Guard on rsp->qpair and ha->wq\nto match the INIT_WORK() condition and avoid operating on an\nuninitialized work_struct."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/qla2xxx/qla_mid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"68ca949cdb04b4dc71451a999148fbc5f187a220","lessThan":"9bd063c082ef0475dfc28c46f607aa3e90fe13d7","versionType":"git","status":"affected"},{"version":"68ca949cdb04b4dc71451a999148fbc5f187a220","lessThan":"dd6c14db0dbb7774278e62c8114902f953540932","versionType":"git","status":"affected"},{"version":"68ca949cdb04b4dc71451a999148fbc5f187a220","lessThan":"1710a69fd74d0b4bdfcc57c3309b1c4057f70d85","versionType":"git","status":"affected"},{"version":"68ca949cdb04b4dc71451a999148fbc5f187a220","lessThan":"f1f4d1cb93eeeb250eac9405121933e268eefbd3","versionType":"git","status":"affected"},{"version":"68ca949cdb04b4dc71451a999148fbc5f187a220","lessThan":"19788a55cab61d78e33e0914a5a31d27843e8a4a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/qla2xxx/qla_mid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.31","status":"affected"},{"version":"0","lessThan":"2.6.31","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1710a69fd74d0b4bdfcc57c3309b1c4057f70d85","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/19788a55cab61d78e33e0914a5a31d27843e8a4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9bd063c082ef0475dfc28c46f607aa3e90fe13d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd6c14db0dbb7774278e62c8114902f953540932","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1f4d1cb93eeeb250eac9405121933e268eefbd3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97537","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:03.973","lastModified":"2026-10-21T13:21:13.160","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking\n\nqla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing\nbugs exposed on the error path of qla25xx_create_{req,rsp}_que():\n\n 1. When dma_alloc_coherent() fails during queue creation, the error\n    path calls the free function with req->ring / rsp->ring still NULL\n    (from kzalloc).  The unconditional dma_free_coherent() with a NULL\n    cpu_addr is undefined behavior and can panic.\n\n 2. The free functions clear req_qid_map / rsp_qid_map under vport_lock,\n    but the create functions protect the same bitmaps with mq_lock.\n    This provides no mutual exclusion.  Additionally, the create error\n    path clears the bit and releases mq_lock before calling the free\n    function, creating a window where another thread can allocate the\n    same que_id and have its ha->req_q_map entry clobbered by the\n    subsequent lockless NULL assignment in the free function.\n\nFix by:\n\n - Guarding dma_free_coherent() with a NULL check on the ring pointer.\n\n - Using mq_lock (the lock held by all creators) in the free functions\n   to atomically NULL the map entry and clear the bitmap bit.\n\n - Removing the now-redundant clear_bit blocks from the create error\n   paths since the free functions handle it atomically."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/qla2xxx/qla_mid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"73208dfd7ab19f379d73e8a0fbf30f92c203e5e8","lessThan":"2e6f60adf609c77e828f64e0cd371920bef91c12","versionType":"git","status":"affected"},{"version":"73208dfd7ab19f379d73e8a0fbf30f92c203e5e8","lessThan":"56e25d716833604fd5bff388e472f290bfe793aa","versionType":"git","status":"affected"},{"version":"73208dfd7ab19f379d73e8a0fbf30f92c203e5e8","lessThan":"f35cb67f2092b49d7949065dd56895ed47238f22","versionType":"git","status":"affected"},{"version":"73208dfd7ab19f379d73e8a0fbf30f92c203e5e8","lessThan":"94fc0c5b45de2bf3a691619bcfd10b9a49fc647e","versionType":"git","status":"affected"},{"version":"73208dfd7ab19f379d73e8a0fbf30f92c203e5e8","lessThan":"34a40e0dff940ac5eba494a69b553ea571e24873","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/qla2xxx/qla_mid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.29","status":"affected"},{"version":"0","lessThan":"2.6.29","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2e6f60adf609c77e828f64e0cd371920bef91c12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/34a40e0dff940ac5eba494a69b553ea571e24873","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/56e25d716833604fd5bff388e472f290bfe793aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94fc0c5b45de2bf3a691619bcfd10b9a49fc647e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f35cb67f2092b49d7949065dd56895ed47238f22","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97538","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:04.080","lastModified":"2026-10-21T13:21:13.280","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (asus_rog_ryujin) Validate HID report lengths\n\nrog_ryujin_raw_event() parses response headers and payload fields without\nfirst checking that they are present in the received report. A short report\ncan therefore make the driver consume uninitialized bytes from the HID\ntransport buffer and expose them as sensor values through sysfs.\n\nValidate the response header and the fields used by each response type\nbefore parsing them."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/asus_rog_ryujin.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ed3e03790c5c9f29f032dde9bb784e198984a759","lessThan":"995f22b2881835b518b3f99240d00781c9df0235","versionType":"git","status":"affected"},{"version":"ed3e03790c5c9f29f032dde9bb784e198984a759","lessThan":"1caa5f9399ff107a8fa221b1eaca0a9e729d3758","versionType":"git","status":"affected"},{"version":"ed3e03790c5c9f29f032dde9bb784e198984a759","lessThan":"8042312e73c50de82634ce63eae7cf219464b481","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/asus_rog_ryujin.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1caa5f9399ff107a8fa221b1eaca0a9e729d3758","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8042312e73c50de82634ce63eae7cf219464b481","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/995f22b2881835b518b3f99240d00781c9df0235","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97539","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:04.197","lastModified":"2026-10-19T10:17:22.950","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xusbatm: don't rely on id table pointer arithmetic\n\nThe current code is broken when dynamic ID is involved; in such cases\nusb_device_id parameter of probe lives on the heap and the pointer\narithmetic will get an index that is wildly out of bound. xusbatm\ninitialize the USB device IDs dynamically so it can just use driver_info\ntoo.\n\nEven with conversion, xusbatm still cannot support dynamic IDs, so also set\nno_dynamic_id."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/atm/xusbatm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"733260ff9c45bd4db60f45d17e8560a4a68dff4d","lessThan":"ee4006c2175e8b50ff5d47a54bff52eb29bb1f0d","versionType":"git","status":"affected"},{"version":"733260ff9c45bd4db60f45d17e8560a4a68dff4d","lessThan":"5086f5639197f321b766cec0dce383492eaf2305","versionType":"git","status":"affected"},{"version":"733260ff9c45bd4db60f45d17e8560a4a68dff4d","lessThan":"fad6cab36474758abf55c6419dd79a06a27fcefc","versionType":"git","status":"affected"},{"version":"733260ff9c45bd4db60f45d17e8560a4a68dff4d","lessThan":"8944ef1bfda537aaf329c82e7a5f9faf61340aa9","versionType":"git","status":"affected"},{"version":"733260ff9c45bd4db60f45d17e8560a4a68dff4d","lessThan":"f7db611d98b68d15661561d2cefa774208774ccc","versionType":"git","status":"affected"},{"version":"733260ff9c45bd4db60f45d17e8560a4a68dff4d","lessThan":"eb6cd6d3d8abeac5d7e8251b898067184afdad8a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/atm/xusbatm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.16","status":"affected"},{"version":"0","lessThan":"2.6.16","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5086f5639197f321b766cec0dce383492eaf2305","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8944ef1bfda537aaf329c82e7a5f9faf61340aa9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb6cd6d3d8abeac5d7e8251b898067184afdad8a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee4006c2175e8b50ff5d47a54bff52eb29bb1f0d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f7db611d98b68d15661561d2cefa774208774ccc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fad6cab36474758abf55c6419dd79a06a27fcefc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97540","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:04.310","lastModified":"2026-10-19T10:17:23.053","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: don't rely on id table pointer arithmetic\n\nThe current code is broken when dynamic ID is involved; in such cases\nusb_device_id parameter of probe lives on the heap and the pointer\narithmetic will get an index that is wildly out of bound. Instead of\nkeeping a side table for additional information, use driver_info field of\nthe usb_device_id.\n\nThe dynamic ID parsing code needs to be updated for this; convert it to\njust write to the reserved entry for dynamic ID and remove the weird loop."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/usb/pegasus.c","drivers/net/usb/pegasus.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"733260ff9c45bd4db60f45d17e8560a4a68dff4d","lessThan":"7c940a1100cb0aa18a54dc48d736c0525c0f400c","versionType":"git","status":"affected"},{"version":"733260ff9c45bd4db60f45d17e8560a4a68dff4d","lessThan":"05d47f540d85c8f6697ec5cfc1aa7b4f96a5b31b","versionType":"git","status":"affected"},{"version":"733260ff9c45bd4db60f45d17e8560a4a68dff4d","lessThan":"9425a13960ef38bac237608f25c9ee64ff113086","versionType":"git","status":"affected"},{"version":"733260ff9c45bd4db60f45d17e8560a4a68dff4d","lessThan":"7654812b65047349ea4c111eed42c4315a00e462","versionType":"git","status":"affected"},{"version":"733260ff9c45bd4db60f45d17e8560a4a68dff4d","lessThan":"61b84e964a829d534f24eab4cbd4035d22b52601","versionType":"git","status":"affected"},{"version":"733260ff9c45bd4db60f45d17e8560a4a68dff4d","lessThan":"ce8101c331956bbd3e20681331dfd22eb7c1c1ea","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/usb/pegasus.c","drivers/net/usb/pegasus.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.16","status":"affected"},{"version":"0","lessThan":"2.6.16","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/05d47f540d85c8f6697ec5cfc1aa7b4f96a5b31b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61b84e964a829d534f24eab4cbd4035d22b52601","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7654812b65047349ea4c111eed42c4315a00e462","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c940a1100cb0aa18a54dc48d736c0525c0f400c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9425a13960ef38bac237608f25c9ee64ff113086","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce8101c331956bbd3e20681331dfd22eb7c1c1ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97541","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:04.423","lastModified":"2026-10-19T10:17:23.153","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k_htc: don't store usb_device_id\n\nusb_device_id is not guaranteed to live longer than probe due to presence\nof dynamic ID. All information apart from driver_data can be easily\nretrieved from usb_device, so just store driver_data."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath9k/hif_usb.c","drivers/net/wireless/ath/ath9k/hif_usb.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0ed7b93e307fd02188a33b80897069d3acc76485","lessThan":"664ef8ce390fa6575c3a3dc003f9ccdd7cca9932","versionType":"git","status":"affected"},{"version":"0ed7b93e307fd02188a33b80897069d3acc76485","lessThan":"8cb99d4a715939b9fcea3341b08eaf4b9e0cc44b","versionType":"git","status":"affected"},{"version":"0ed7b93e307fd02188a33b80897069d3acc76485","lessThan":"8e70a6785bd02cf9ef7fd21ebccf46a8ba23014e","versionType":"git","status":"affected"},{"version":"0ed7b93e307fd02188a33b80897069d3acc76485","lessThan":"9d5e396578097d02e859798207db41ed4b831f50","versionType":"git","status":"affected"},{"version":"0ed7b93e307fd02188a33b80897069d3acc76485","lessThan":"c34aa59950597e3360e9cef9d08cdf4edb30ad4d","versionType":"git","status":"affected"},{"version":"0ed7b93e307fd02188a33b80897069d3acc76485","lessThan":"14d2ac442d660e112efc0ce87ad10085013ed2b1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath9k/hif_usb.c","drivers/net/wireless/ath/ath9k/hif_usb.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.4","status":"affected"},{"version":"0","lessThan":"3.4","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/14d2ac442d660e112efc0ce87ad10085013ed2b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/664ef8ce390fa6575c3a3dc003f9ccdd7cca9932","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8cb99d4a715939b9fcea3341b08eaf4b9e0cc44b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e70a6785bd02cf9ef7fd21ebccf46a8ba23014e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d5e396578097d02e859798207db41ed4b831f50","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c34aa59950597e3360e9cef9d08cdf4edb30ad4d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97542","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:04.540","lastModified":"2026-10-19T10:17:23.253","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: bail out on bitmap errors in xrep_agfl_fill\n\nLOLLM also points out that the xagb_bitmap_set call in xrep_agfl_fill\ncan fail, but we don't check the result of xagb_bitmap_walk, so we\nsilently drop the error and proceed with inconsistent incore data.\nThat shouldn't be allowed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/xfs/scrub/agheader_repair.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"014ad53732d2bac34d21a251f3622a4da516e21b","lessThan":"c2bf1299aeff6db186aa0db8d19328e1816f0e39","versionType":"git","status":"affected"},{"version":"014ad53732d2bac34d21a251f3622a4da516e21b","lessThan":"e49977bc568c2649cf1a37992e538df8e3779ee4","versionType":"git","status":"affected"},{"version":"014ad53732d2bac34d21a251f3622a4da516e21b","lessThan":"82a0fd3fe908914425798b6be2b9b0a4f69ff84d","versionType":"git","status":"affected"},{"version":"014ad53732d2bac34d21a251f3622a4da516e21b","lessThan":"b5309ae6504e9b727d83bdfb2a19f44896a8f019","versionType":"git","status":"affected"},{"version":"014ad53732d2bac34d21a251f3622a4da516e21b","lessThan":"eaf580538eb1be3d162400d04c4b7dc4c627296b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/xfs/scrub/agheader_repair.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/82a0fd3fe908914425798b6be2b9b0a4f69ff84d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5309ae6504e9b727d83bdfb2a19f44896a8f019","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2bf1299aeff6db186aa0db8d19328e1816f0e39","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e49977bc568c2649cf1a37992e538df8e3779ee4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eaf580538eb1be3d162400d04c4b7dc4c627296b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97543","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:04.643","lastModified":"2026-10-19T10:17:23.347","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: destroy seen inode bitmap when we fail to add a dirpath\n\nLOLLM observes a memory leak in xchk_dirtree_create_path if we create\nthe directory path object but appending the name to the path fails.\nWhen this happens, we don't tear down the (empty) seen inode bitmap.\nThis is a pretty trivial error, but let's not leave logic bombs.\n\nDo the same for a similar bug in xrep_dirtree_create_adoption_path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/xfs/scrub/dirtree.c","fs/xfs/scrub/dirtree_repair.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"928b721a11789a9363d6d7c32a1f3166a79f3b5f","lessThan":"3b10ca4302ee2dda4233f70b2033883ee376fa6a","versionType":"git","status":"affected"},{"version":"928b721a11789a9363d6d7c32a1f3166a79f3b5f","lessThan":"0b756de8167f2f06ffceadc71cb17c1fc7be4be8","versionType":"git","status":"affected"},{"version":"928b721a11789a9363d6d7c32a1f3166a79f3b5f","lessThan":"582f54dce62043f7a0503ab8c76d718d0293da59","versionType":"git","status":"affected"},{"version":"928b721a11789a9363d6d7c32a1f3166a79f3b5f","lessThan":"1a441c6842da75c5b862cc1c9f7969d6a93b54b9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/xfs/scrub/dirtree.c","fs/xfs/scrub/dirtree_repair.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0b756de8167f2f06ffceadc71cb17c1fc7be4be8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1a441c6842da75c5b862cc1c9f7969d6a93b54b9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b10ca4302ee2dda4233f70b2033883ee376fa6a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/582f54dce62043f7a0503ab8c76d718d0293da59","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97544","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:04.753","lastModified":"2026-10-19T10:17:23.437","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't leak dqacct if rhashtable insertion fails\n\nLOLLM observes that xqcheck_mod_live_ino_dqtrx doesn't free the newly\nallocated dqa object if rhashtable insertion fails.  Fix this leak."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/xfs/scrub/quotacheck.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"200491875ce144fdc49827387fff2f604b73c0a9","lessThan":"9036e078bd51683e862afd5ed25ecba2f780b165","versionType":"git","status":"affected"},{"version":"200491875ce144fdc49827387fff2f604b73c0a9","lessThan":"7791970a76a3e23f6f51451dbb1e48bd57f94f93","versionType":"git","status":"affected"},{"version":"200491875ce144fdc49827387fff2f604b73c0a9","lessThan":"788c3a46ef9d79f875312b95cffe0961a13167a7","versionType":"git","status":"affected"},{"version":"200491875ce144fdc49827387fff2f604b73c0a9","lessThan":"2eac8d01d2c776fc26b0ac74aebdf91bc4490891","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/xfs/scrub/quotacheck.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2eac8d01d2c776fc26b0ac74aebdf91bc4490891","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7791970a76a3e23f6f51451dbb1e48bd57f94f93","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/788c3a46ef9d79f875312b95cffe0961a13167a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9036e078bd51683e862afd5ed25ecba2f780b165","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97545","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:04.860","lastModified":"2026-10-19T10:17:23.520","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't leak new_bp if xfs_btree_bload_drop_buf fails\n\nLOLLM observes that in xfs_btree_bload_prep_block,\nxfs_btree_bload_drop_buf can hit an IO error if writing the delwri\nbuffer list to disk fails.  In this case, we fail to release new_bp,\nwhich means we lose a locked buffer.  Fix that."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/xfs/libxfs/xfs_btree_staging.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e069d549705e49841247acf9b3176744e27d5425","lessThan":"355b8a5d7e9a38fca8dbf7a4721450252ac7868f","versionType":"git","status":"affected"},{"version":"e069d549705e49841247acf9b3176744e27d5425","lessThan":"176a53af77b430e1c19ee15fc492145ace666de7","versionType":"git","status":"affected"},{"version":"e069d549705e49841247acf9b3176744e27d5425","lessThan":"b19dfd4546088a0823e0c47f8ceb6b2775bd1ac7","versionType":"git","status":"affected"},{"version":"e069d549705e49841247acf9b3176744e27d5425","lessThan":"f1930bc578095409c2dcfca6e4e898b24f0f0de6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/xfs/libxfs/xfs_btree_staging.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/176a53af77b430e1c19ee15fc492145ace666de7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/355b8a5d7e9a38fca8dbf7a4721450252ac7868f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b19dfd4546088a0823e0c47f8ceb6b2775bd1ac7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1930bc578095409c2dcfca6e4e898b24f0f0de6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97546","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:04.963","lastModified":"2026-10-19T10:17:23.610","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't spin forever on zero-length dirents when salvaging them\n\nLOLLM noticed that xrep_dir_recover_data can spin forever if it\nencounters an unused dirent that claims to have length zero.  Fix that,\nand prevent the same thing from happening with a zero-length entry."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/xfs/scrub/dir_repair.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b1991ee3e7cf852e95a3498801303cfbb4468681","lessThan":"5442f0c56445618544a801fb4dae35aed87a1aaa","versionType":"git","status":"affected"},{"version":"b1991ee3e7cf852e95a3498801303cfbb4468681","lessThan":"08754ebfa5c28e8d57316b1bd7a5a921a5e2e762","versionType":"git","status":"affected"},{"version":"b1991ee3e7cf852e95a3498801303cfbb4468681","lessThan":"a455c83ce5dc1a2da33b1b84253d298372a8dfbd","versionType":"git","status":"affected"},{"version":"b1991ee3e7cf852e95a3498801303cfbb4468681","lessThan":"9f84792b40d0c96833341602144574bf0bd14a6a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/xfs/scrub/dir_repair.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/08754ebfa5c28e8d57316b1bd7a5a921a5e2e762","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5442f0c56445618544a801fb4dae35aed87a1aaa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f84792b40d0c96833341602144574bf0bd14a6a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a455c83ce5dc1a2da33b1b84253d298372a8dfbd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97547","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:05.070","lastModified":"2026-10-19T10:17:23.697","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN\n\nWhen exchanging two full-file ranges, xmi_can_exchange_reflink_flags()\ncan move the reflink inode flag from the file that currently has it to\nthe other file, as long as exactly one side is marked.  This assumes\nthat the file contents, and therefore all shared extents, are exchanged.\n\nThat assumption is not true when XFS_EXCHMAPS_INO1_WRITTEN is set.\nxfs_exchmaps_can_skip_mapping() can skip hole and unwritten mappings\nfrom file1, so an exchange can complete without moving every mapping\nthat the earlier flag-swap decision accounted for.  In that case the\npost-operation cleanup can clear the reflink flag from an inode that\nstill owns shared written extents.  Later writes then take the\nnon-reflink write path and may update blocks that should still have\nbeen protected by CoW, which shows up as data corruption between\nreflink-related files.\n\nFix this by disabling the reflink flag exchange whenever\nXFS_EXCHMAPS_INO1_WRITTEN is requested.  The contents exchange can still\nproceed; the conservative outcome is that both inodes keep the reflink\nflag.  The regular reflink flag cleanup path can drop the extra flag\nlater once the inode no longer has shared extents."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/xfs/libxfs/xfs_exchmaps.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"966ceafc7a437105ecfe1cadb3747b2965a260ca","lessThan":"56f87ac2b9543be2be529b831666682e6df4bc40","versionType":"git","status":"affected"},{"version":"966ceafc7a437105ecfe1cadb3747b2965a260ca","lessThan":"fac32b9950a2aab3f8659d23b2947b8fb305c3fe","versionType":"git","status":"affected"},{"version":"966ceafc7a437105ecfe1cadb3747b2965a260ca","lessThan":"8ae30b9a8c207f9bd03a98eda7b5d641daa79bdb","versionType":"git","status":"affected"},{"version":"966ceafc7a437105ecfe1cadb3747b2965a260ca","lessThan":"a23eca88448e52eb1a81549862df7adce794fafb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/xfs/libxfs/xfs_exchmaps.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/56f87ac2b9543be2be529b831666682e6df4bc40","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8ae30b9a8c207f9bd03a98eda7b5d641daa79bdb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a23eca88448e52eb1a81549862df7adce794fafb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fac32b9950a2aab3f8659d23b2947b8fb305c3fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97548","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:05.183","lastModified":"2026-10-19T10:17:23.790","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions\n\nThe _maxlevels_ondisk functions are used to compute the size of\nin-memory btree cursors for each btree type.  Unfortunately, LOLLM\nnoticed that the rtrmap and rtrefcount versions of these functions\nforget to account for the inode root, which means that we could access\nbeyond the end of the cursor given a sufficiently large btree.  Fix\nthis."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/xfs/libxfs/xfs_rtrefcount_btree.c","fs/xfs/libxfs/xfs_rtrmap_btree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9abe03a0e4f978615a2b1b484b8d09ca84c16ea0","lessThan":"108114437915e61e8f88d1cbcc442c3f886a347e","versionType":"git","status":"affected"},{"version":"9abe03a0e4f978615a2b1b484b8d09ca84c16ea0","lessThan":"84316cb25af95a60e655ccc8fe646bb5ad631b71","versionType":"git","status":"affected"},{"version":"9abe03a0e4f978615a2b1b484b8d09ca84c16ea0","lessThan":"aa301322f72f82f26e4ba0826018d41388ab9896","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/xfs/libxfs/xfs_rtrefcount_btree.c","fs/xfs/libxfs/xfs_rtrmap_btree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/108114437915e61e8f88d1cbcc442c3f886a347e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/84316cb25af95a60e655ccc8fe646bb5ad631b71","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa301322f72f82f26e4ba0826018d41388ab9896","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97549","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:05.290","lastModified":"2026-10-19T10:17:23.903","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix under-reservation of blocks when repairing sf directories\n\nWhilst running QA on XFS for-next as of 7.3-rc2 with MKFS_OPTIONS=\"-n\nsize=8192\", I observed the following (trimmed) dmesg splat:\n\n XFS: Assertion failed: args->total >= dp->i_nblocks - nblks, file: fs/xfs/libxfs/xfs_da_btree.c, line: 2387\n WARNING: fs/xfs/xfs_message.c:104 at assfail+0x46/0x4a [xfs], CPU#0: xfs_scrub/1426511\n CPU: 0 UID: 0 PID: 1426511 Comm: xfs_scrub Tainted: G        W           7.3.0-rc2-djwx #rc2 PREEMPT(lazy)  6e418570b606a39783b0e7e7b30dc407b965f9e8\n Tainted: [W]=WARN\n RIP: 0010:assfail+0x46/0x4a [xfs]\n RSP: 0018:ffffc900010d7890 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000ffffffd1\n RDX: 0000000000000000 RSI: 0000000000000021 RDI: ffffffffa059fd38\n RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000\n R10: 000000000000000a R11: 000000007fffffff R12: ffffc900010d7940\n R13: ffff888368d8f980 R14: ffffc900010d7a48 R15: ffffc900010d78d0\n FS:  00007f445c5ce680(0000) GS:ffff8884a97ea000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f443803b9a8 CR3: 0000000107a4b000 CR4: 00000000003506f0\n Call Trace:\n  <TASK>\n  xfs_da_grow_inode_int+0x2e0/0x300 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xfs_dir2_grow_inode+0x6e/0x150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xfs_dir2_sf_to_block+0x149/0x870 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xrep_dir_swap_prep+0xe2/0x110 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xrep_dir_swap+0xfb/0x2f0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xrep_dir_rebuild_tree+0x99/0x100 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xrep_directory+0x83/0x1c0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xrep_attempt+0x4f/0x1e0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xfs_scrub_metadata+0x393/0x5b0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xfs_ioc_scrubv_metadata+0x306/0x570 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xfs_file_ioctl+0xa4f/0x1150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  __x64_sys_ioctl+0x76/0xc0\n  do_syscall_64+0x7a/0x3b0\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThis is a consequence of commit 0fe77e57588b98, which added the\nfollowing assertion to xfs_da_grow_inode_int:\n\n ASSERT(args->total >= dp->i_nblocks - nblks);\n\nTracing this back to xrep_dir_swap_prep, I noticed that the xfs_da_args\nobject that's passed to xfs_dir2_sf_to_block sets args->total to 1.\nThis is incorrect because mkfs set the directory block size to 8k and\nthe filesystem block size to 4k.  In other words, args->total should be\n2 here, not 1.\n\nDave Chinner tripped over the same problem with the same branch through\na different channel -- his test setup set the fs block size to 1k, in\nwhich case the directory block size is still set to 4k.  Here,\nargs->total should be 4.\n\nChanging the assignment of args->total to sc->mp->m_dir_geo->fsbcount\nmakes the assertion go away, but that isn't a complete fix.  In\nxrep_tempexch_estimate, we also incorrectly assume that a shortform\nconversion requires 1 fsblock when it should be m_dir_geo->fsbcount.\nWithout that, we can under-reserve space in the transaction and cause a\nfilesystem shutdown.\n\nNote that the xfs_dabuf_nfsb helper will compute the correct value for\ndirectories and xattr, so we use that instead of open-coding the logic.\nAlso fix xrep_xattr_swap_prep to assign args->total via xfs_dabuf_nfsb\nto avoid one logic bomb if we ever support multi-fsblock attrs.\n\nTripped-by: 0fe77e57588b98 (\"xfs: assert the reservation covers each da fork growth\")"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/xfs/libxfs/xfs_da_btree.c","fs/xfs/libxfs/xfs_da_btree.h","fs/xfs/scrub/attr_repair.c","fs/xfs/scrub/dir_repair.c","fs/xfs/scrub/tempfile.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"629fdaf5f5b1b7f7107ed4de04e0991a99501ced","lessThan":"996cce0c422b66a0e8b1a99505f896b0669ee5b6","versionType":"git","status":"affected"},{"version":"629fdaf5f5b1b7f7107ed4de04e0991a99501ced","lessThan":"b8f46ca5cbd629ffb91489ad7f970b3837835b0a","versionType":"git","status":"affected"},{"version":"629fdaf5f5b1b7f7107ed4de04e0991a99501ced","lessThan":"b950e84acd072ac648ace4fea53c0b1212da4b2c","versionType":"git","status":"affected"},{"version":"629fdaf5f5b1b7f7107ed4de04e0991a99501ced","lessThan":"4d3c07591534517c633945c8d8e6526f10e3fabc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/xfs/libxfs/xfs_da_btree.c","fs/xfs/libxfs/xfs_da_btree.h","fs/xfs/scrub/attr_repair.c","fs/xfs/scrub/dir_repair.c","fs/xfs/scrub/tempfile.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4d3c07591534517c633945c8d8e6526f10e3fabc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/996cce0c422b66a0e8b1a99505f896b0669ee5b6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8f46ca5cbd629ffb91489ad7f970b3837835b0a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b950e84acd072ac648ace4fea53c0b1212da4b2c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97550","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:05.423","lastModified":"2026-10-19T10:17:24.027","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix unit conversions in per_binval computation\n\nLOLLM noticed that we're doing the unit conversion in the per_binval\ncomputation backwards -- xfs_buf_inval_log_space's second parameter is\nsupposed to be in bytes, but max_binval is in units of fsblocks.  Hence\nthe conversion should be FSB -> B, not the other way around."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/xfs/scrub/reap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b2311ec6778fcde9d40cd9e22899f8bd594d8465","lessThan":"b5089a328acc83fe2f23127a79397a0bfd9ebc33","versionType":"git","status":"affected"},{"version":"b2311ec6778fcde9d40cd9e22899f8bd594d8465","lessThan":"cfeba3bdf4dfa405e29f4ee13a20e9063fd0b7ef","versionType":"git","status":"affected"},{"version":"b2311ec6778fcde9d40cd9e22899f8bd594d8465","lessThan":"05cff7c2b79f76c7cfe90613a60e16aaaa051ef7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/xfs/scrub/reap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/05cff7c2b79f76c7cfe90613a60e16aaaa051ef7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5089a328acc83fe2f23127a79397a0bfd9ebc33","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfeba3bdf4dfa405e29f4ee13a20e9063fd0b7ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97551","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:05.530","lastModified":"2026-10-19T10:17:24.117","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: initialise args->total for parent pointer updates\n\nxfs_parent_da_args_init() builds an xfs_da_args from a zeroed\nxfs_parent_args (kmem_cache_zalloc), leaving args->total == 0.\nxfs_da_grow_inode_int() treats that field as a running block reservation\nand subtracts from it; because it is an xfs_extlen_t (uint32_t), the\nfirst attr-fork growth wraps it to ~0U.  That defeats the free-space\ncheck in xfs_alloc_space_available(), and when it coincides with an AG\nthat has exactly zero available blocks the allocation is clamped to\nmaxlen 0 and returns -ENOSPC, which xfs_defer_finish_noroll() escalates\nto a filesystem shutdown.\n\nSet args->total the way the log recovery path does\n(xfs_attri_recover_work(), xfs_attr_item.c:706), in the add and replace\npaths that can grow the fork.  Removals and lookups never grow it, so\nthey leave the field alone, matching that switch."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/xfs/libxfs/xfs_parent.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b7c62d90c12c6cc86f10b8a62cefe0029374b6ff","lessThan":"9ad85bce62cadfdf4242f6e6bbff2a52e51d30f1","versionType":"git","status":"affected"},{"version":"b7c62d90c12c6cc86f10b8a62cefe0029374b6ff","lessThan":"c66e138af626cad4210da449996ae9e07ee63add","versionType":"git","status":"affected"},{"version":"b7c62d90c12c6cc86f10b8a62cefe0029374b6ff","lessThan":"ac9032882d673dd6679e1d873a2dc0131a1aeb43","versionType":"git","status":"affected"},{"version":"b7c62d90c12c6cc86f10b8a62cefe0029374b6ff","lessThan":"8e4ebb6afaa34bd2e8ce52da231003d24111c2d6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/xfs/libxfs/xfs_parent.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/8e4ebb6afaa34bd2e8ce52da231003d24111c2d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9ad85bce62cadfdf4242f6e6bbff2a52e51d30f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac9032882d673dd6679e1d873a2dc0131a1aeb43","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c66e138af626cad4210da449996ae9e07ee63add","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97552","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:05.647","lastModified":"2026-10-19T10:17:24.207","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: initialise error in xfs_defer_finish_one()\n\nxfs_defer_finish_one() declares error without an initialiser and only\nassigns it inside the loop over dfp->dfp_work.  When that list is empty\nthe loop body never runs, control falls through to the \"Done with the\ndfp, free it\" path, and the function returns an indeterminate value.\n\nAn item-less pending item reaches this through xfs_defer_add_barrier(),\nwhich xfs_reap_ag_blocks() uses on any CONFIG_XFS_ONLINE_REPAIR kernel.\nxfs_defer_finish_noroll() treats any non-EAGAIN return as fatal, so a\nnon-zero stack value turns a successful barrier into a\nSHUTDOWN_CORRUPT_INCORE in the middle of a repair.  Zero is the correct\nresult: reaching the free path means the item loop drained without a\nnon-zero error."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/xfs/libxfs/xfs_defer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3f3cec031099c37513727efc978a12b6346e326d","lessThan":"30748a24b9f04f9a83599ba907cc8fbff0729f3c","versionType":"git","status":"affected"},{"version":"3f3cec031099c37513727efc978a12b6346e326d","lessThan":"ba949a14446b7346e92e676ee3fe2bb79d9ce450","versionType":"git","status":"affected"},{"version":"3f3cec031099c37513727efc978a12b6346e326d","lessThan":"6b507c239884f7d4bf8339f6e9eb8bfcb540afde","versionType":"git","status":"affected"},{"version":"3f3cec031099c37513727efc978a12b6346e326d","lessThan":"6176d21d7bd609632c5b7e87a3adb9be29ec1e72","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/xfs/libxfs/xfs_defer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/30748a24b9f04f9a83599ba907cc8fbff0729f3c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6176d21d7bd609632c5b7e87a3adb9be29ec1e72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b507c239884f7d4bf8339f6e9eb8bfcb540afde","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba949a14446b7346e92e676ee3fe2bb79d9ce450","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97553","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:05.757","lastModified":"2026-10-19T10:17:24.310","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: lock the healthmon when inserting unmount event\n\nLOLLM complains that xfs_healthmon_unmount does an unlocked insert of\nthe unmount event into the health monitor's event list.  Fix that."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/xfs/xfs_healthmon.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"25ca57fa3624cae9c6b5c6d3fc7f38318ca1402e","lessThan":"d963ce1910bc4e23c60a4787af8a3aa3498a053e","versionType":"git","status":"affected"},{"version":"25ca57fa3624cae9c6b5c6d3fc7f38318ca1402e","lessThan":"7538ba528cfd6f176076186c1b1678fdca1c197b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/xfs/xfs_healthmon.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/7538ba528cfd6f176076186c1b1678fdca1c197b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d963ce1910bc4e23c60a4787af8a3aa3498a053e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97554","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:05.860","lastModified":"2026-10-21T13:21:13.380","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()\n\ncifs_posix_to_fattr() ignores the return value of posix_info_parse().\nWhen a malformed POSIX directory entry is encountered (e.g. invalid\nSID lengths from an untrusted server), posix_info_parse() returns -1\nwithout populating the 'parsed' struct.  The uninitialized stack\nmemory in parsed.owner and parsed.group is then passed to\nsid_to_id(), which processes the garbage bytes and passes them to\nrequest_key() to construct a SID string, potentially leaking kernel\nstack contents to the userspace idmap daemon.\n\nFix this by checking the return value and skipping the SID-to-id\nmapping when parsing fails.  The remaining fattr fields (timestamps,\nmode, etc.) are populated directly from the 'info' pointer so they\nare unaffected."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/readdir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9934430e2178d5164eb1ac91a9b092f9e7e64745","lessThan":"604feb3e8141bf11f5afd48d36d401fee5af9536","versionType":"git","status":"affected"},{"version":"9934430e2178d5164eb1ac91a9b092f9e7e64745","lessThan":"33106019c3be57b5fc6411cfaad6d98214a51265","versionType":"git","status":"affected"},{"version":"9934430e2178d5164eb1ac91a9b092f9e7e64745","lessThan":"2be31f252ade791b84f7164991f14436aed1d4b9","versionType":"git","status":"affected"},{"version":"9934430e2178d5164eb1ac91a9b092f9e7e64745","lessThan":"c9a8b60ce140a68d172452f418137fc7ddbae7db","versionType":"git","status":"affected"},{"version":"9934430e2178d5164eb1ac91a9b092f9e7e64745","lessThan":"da6e25842431982d5a53cf00d925b98c690f4467","versionType":"git","status":"affected"},{"version":"dd80b98bdf0a4b3206739f3513b0518f27a7b4ef","versionType":"git","status":"affected"},{"version":"d8e39c11f66125f49de55537a6efc8ecadf4a0f7","versionType":"git","status":"affected"},{"version":"5.8.17","lessThan":"5.9","versionType":"semver","status":"affected"},{"version":"5.9.2","lessThan":"5.10","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/readdir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2be31f252ade791b84f7164991f14436aed1d4b9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/33106019c3be57b5fc6411cfaad6d98214a51265","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/604feb3e8141bf11f5afd48d36d401fee5af9536","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9a8b60ce140a68d172452f418137fc7ddbae7db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da6e25842431982d5a53cf00d925b98c690f4467","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97555","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:05.963","lastModified":"2026-10-19T10:17:24.497","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix heap overflow in DACL owner/group rewrite\n\nWhen id_mode_to_cifs_acl rewrites an existing DACL, it allocates a\nbuffer sized according to the on-disk DACL length reported by\ndacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each\nACE with a new owner/group SID obtained from the cifs.idmap upcall.\nThose SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities,\nmaking each ACE up to 76 bytes (sizeof(struct smb_ace)).\n\nIf the original DACL contains short SIDs (e.g., 1 sub-authority) while\nthe replacement SIDs are long, the rewritten ACEs overflow the\nallocation.\n\nFix this by always budgeting for worst-case SID expansion: allocate\nsizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which\ncovers the smb_acl header and room for every ACE at maximum SID size.\nThis replaces the previous split logic that used dacl_ptr->size for\ncifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid\nmounts: both paths can trigger the same rewrite and need the same\nheadroom.\n\nKASAN reports this as:\n  BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs]\n  Write of size 4 at addr ffff8881a5e25374 by task chown/5298\n  ...\n  The buggy address is located 0 bytes to the right of\n   allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","lessThan":"d5cea6766ae1868a51c7d17d77d065b4f55c587f","versionType":"git","status":"affected"},{"version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","lessThan":"fb736ab4fb8c4fdb8b2f9ccd3a62e03d11549ca1","versionType":"git","status":"affected"},{"version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","lessThan":"7fa84c9ca690643f429ae2709584a47e74b572c9","versionType":"git","status":"affected"},{"version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","lessThan":"2a9aee9ef5622d58d8aafaa3263b3ffe70e2d9dd","versionType":"git","status":"affected"},{"version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","lessThan":"0ee150794c75bcd0be0e24ff3394f433cbae18cc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0ee150794c75bcd0be0e24ff3394f433cbae18cc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a9aee9ef5622d58d8aafaa3263b3ffe70e2d9dd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7fa84c9ca690643f429ae2709584a47e74b572c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5cea6766ae1868a51c7d17d77d065b4f55c587f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fb736ab4fb8c4fdb8b2f9ccd3a62e03d11549ca1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97556","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:06.077","lastModified":"2026-10-19T10:17:24.623","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: avoid leaking refcount when cifs_sb_tlink() fails\n\ncifs_oplock_break() takes over the reference that\ncifs_queue_oplock_break() acquired when it queued the work, and drops it\nwith _cifsFileInfo_put() once the break has been processed.\n\nOnly in setups with \"-o multiuser\", cifs_sb_tlink() may fail, at which\npoint cifs_oplock_break() returns without putting the file reference,\nmirroring the reference leak we already fixed in the companion patch to\ncifs_queue_oplock_break().\n\nThis would trigger a crash due to busy inodes on the next unmount:\n\n  BUG: Dentry ... still in use (1) [unmount of cifs cifs]\n  VFS: Busy inodes after unmount of cifs (cifs)\n\nDrop the reference on that path as well. Doing so before the out label\nmirrors the normal path, which also puts the reference before\ncifs_done_oplock_break().\n\nFound by Sashiko code review. The failure path was not exercised at\nruntime."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5ee28bcfbaacf289eb25c662a2862542ea6ce6a7","lessThan":"55c5f095d4df14271b238f826e1392fda7b6e60e","versionType":"git","status":"affected"},{"version":"e8f5f849ffce24490eb9449e98312b66c0dba76f","lessThan":"e9c5bcc88b8337157e480c85a6d2f326bc265012","versionType":"git","status":"affected"},{"version":"e8f5f849ffce24490eb9449e98312b66c0dba76f","lessThan":"9ec991e148368e3207e98134c509a625097f7693","versionType":"git","status":"affected"},{"version":"e8f5f849ffce24490eb9449e98312b66c0dba76f","lessThan":"dd03fd658ea59821505e0e643b6b7cbdf51c4e1d","versionType":"git","status":"affected"},{"version":"e8f5f849ffce24490eb9449e98312b66c0dba76f","lessThan":"1d1b0f1d812a4011a57bc6c70492c34a2e46c6dd","versionType":"git","status":"affected"},{"version":"e8f5f849ffce24490eb9449e98312b66c0dba76f","lessThan":"23b26f4408ac3f35a482d2e5cf6fc865d4201b71","versionType":"git","status":"affected"},{"version":"b99f490ea87ebcca3a429fd8837067feb56a4c7c","versionType":"git","status":"affected"},{"version":"6b67a6d2e50634fe127e656147c81915955e9f5e","versionType":"git","status":"affected"},{"version":"6.1.47","lessThan":"6.1.189","versionType":"semver","status":"affected"},{"version":"5.15.128","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.4.12","lessThan":"6.5","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1d1b0f1d812a4011a57bc6c70492c34a2e46c6dd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/23b26f4408ac3f35a482d2e5cf6fc865d4201b71","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55c5f095d4df14271b238f826e1392fda7b6e60e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9ec991e148368e3207e98134c509a625097f7693","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd03fd658ea59821505e0e643b6b7cbdf51c4e1d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9c5bcc88b8337157e480c85a6d2f326bc265012","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97557","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:06.193","lastModified":"2026-10-19T10:17:24.733","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: avoid leaking refcount in cifs_queue_oplock_break()\n\ncifs_queue_oplock_break() unconditionally takes a reference on the\ntarget file before queueing cifs_oplock_break(). Only that work item\ndecreases the reference counter again.\n\nIf another oplock break arrives while that work is still queued,\nqueue_work() will return false and not queue this second work item. As a\nresult, we will never reach the point to drop the file reference again\nand are leaking this reference. This can be triggered when interacting\nwith a slow-responding server.\n\nAs a result, later unmount operations for this file system will fail with\n\n  BUG: Dentry ... still in use (1) [unmount of cifs cifs]\n  VFS: Busy inodes after unmount of cifs (cifs)\n  kernel BUG at fs/super.c:777!\n\nFix this by only incrementing the reference count if the work has been\nqueued successfully. Taking it after queue_work() is safe because all\nthree callers hold tcon->open_file_lock across the call and\n_cifsFileInfo_put() decrements under that same lock, so a worker that\nstarts the handler in the window cannot drop the reference before it has\nbeen taken."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b98749cac4a695f084a5ff076f4510b23e353ecd","lessThan":"735a3a610136ae10f381d0909dff38e5b5c5f056","versionType":"git","status":"affected"},{"version":"b98749cac4a695f084a5ff076f4510b23e353ecd","lessThan":"de2a6bcff2659bea40c7485115b57f0ae189fc01","versionType":"git","status":"affected"},{"version":"b98749cac4a695f084a5ff076f4510b23e353ecd","lessThan":"af0193bbf1ac8c0f67f972998b0cc629d6116cf6","versionType":"git","status":"affected"},{"version":"b98749cac4a695f084a5ff076f4510b23e353ecd","lessThan":"2ed2c29dd9593637cfa25ac1eb23241b20202778","versionType":"git","status":"affected"},{"version":"b98749cac4a695f084a5ff076f4510b23e353ecd","lessThan":"dfe7b750c7e069873a8a57a11c816831a235618a","versionType":"git","status":"affected"},{"version":"b98749cac4a695f084a5ff076f4510b23e353ecd","lessThan":"9f2e63f1b2d5fc5b5423424902c091123e220e7e","versionType":"git","status":"affected"},{"version":"2429fcf06d3cb962693868ab0a927c9038f12a2d","versionType":"git","status":"affected"},{"version":"1ee4f2d7cdcd4508cc3cbe3b2622d7177b89da12","versionType":"git","status":"affected"},{"version":"53fc31a4853e30d6e8f142b824f724da27ff3e40","versionType":"git","status":"affected"},{"version":"8092ecc306d81186a64cda42411121f4d35aaff4","versionType":"git","status":"affected"},{"version":"ebac4d0adf68f8962bd82fcf483936edd6ec095b","versionType":"git","status":"affected"},{"version":"3.16.72","lessThan":"3.17","versionType":"semver","status":"affected"},{"version":"4.9.171","lessThan":"4.10","versionType":"semver","status":"affected"},{"version":"4.14.114","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.37","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.0.10","lessThan":"5.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.1","status":"affected"},{"version":"0","lessThan":"5.1","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/2ed2c29dd9593637cfa25ac1eb23241b20202778","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/735a3a610136ae10f381d0909dff38e5b5c5f056","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f2e63f1b2d5fc5b5423424902c091123e220e7e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af0193bbf1ac8c0f67f972998b0cc629d6116cf6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de2a6bcff2659bea40c7485115b57f0ae189fc01","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dfe7b750c7e069873a8a57a11c816831a235618a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97558","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:06.320","lastModified":"2026-10-21T13:21:13.507","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix cifsFileInfo reference leak in deferred close\n\nWhen cifs_close() defers a close, it hands the cifsFileInfo reference\nof the closing struct file to the queued work. Each execution of\nsmb2_deferred_work_close() drops one such reference.\n\ndeferred_close_scheduled can be false while the work is pending: the\nworkqueue clears PENDING when the callback starts to run, before the\ncallback clears the flag under deferred_lock. A close in that\ninterval requeues the running work, and the callback then clears the\nflag, leaving the requeued work pending with the flag down. A later\ncifs_open() can reuse the handle and its cifs_close() reaches the\nsame branch: queue_delayed_work() fails because the work is still\npending, but cifs_close() returns without dropping the closing file's\nreference. The cifsFileInfo count stays pinned and its tlink, dentry\nand server handle are leaked.\n\nCheck the return value and hand off the reference only when work was\nactually queued. Otherwise, use the shared _cifsFileInfo_put(), like\nthe mod_delayed_work() branch above: the pending execution already\nowns its reference.\n\nThis issue was found by an in-house static analysis tool."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c3f207ab29f793b8c942ce8067ed123f18d5b81b","lessThan":"525c225e23d61694091f2806de553a69362a78ff","versionType":"git","status":"affected"},{"version":"c3f207ab29f793b8c942ce8067ed123f18d5b81b","lessThan":"bbeb7a42c9ea656e17ddcbdc2d7917aa853383a6","versionType":"git","status":"affected"},{"version":"c3f207ab29f793b8c942ce8067ed123f18d5b81b","lessThan":"a6767712902beb0f53238be485971c9a83ea1079","versionType":"git","status":"affected"},{"version":"c3f207ab29f793b8c942ce8067ed123f18d5b81b","lessThan":"ea93759d6c2789924f4e557aed5be532207715ea","versionType":"git","status":"affected"},{"version":"c3f207ab29f793b8c942ce8067ed123f18d5b81b","lessThan":"5520e89a5a4f834bced64cf2ac927001cc513a40","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.113","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/525c225e23d61694091f2806de553a69362a78ff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5520e89a5a4f834bced64cf2ac927001cc513a40","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6767712902beb0f53238be485971c9a83ea1079","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bbeb7a42c9ea656e17ddcbdc2d7917aa853383a6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea93759d6c2789924f4e557aed5be532207715ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97559","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:06.430","lastModified":"2026-10-21T13:21:13.647","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fail DACL rewrite when the new DACL exceeds 64K\n\nreplace_sids_and_copy_aces() and set_chmod_dacl() accumulate the size of\nthe DACL they build in a u16. That accumulator can wrap.\n\nvalidate_dacl() caps num_aces at (dacl_size - sizeof(struct smb_acl)) /\n20, i.e. 3276 for a maximally sized DACL, while each rewritten ACE can\ngrow to sizeof(struct smb_ace) (76 bytes) once its SID is replaced with\none carrying SID_MAX_SUB_AUTHORITIES sub-authorities. The worst case is\ntherefore sizeof(struct smb_acl) + 3276 * 76 = 248984 bytes, far beyond\nwhat a u16 can hold. A wraparound is reached with 863 ACEs.\n\nAfter the wraparound, ndacl_ptr->size becomes meaningless and the offset\nwill point anywhere in the ACE array. As a result, we will see\ncorruption of the DACL, which then gets sent to the server. This is not\nan out-of-bounds write as the allocation now covers the worst-case\nexpansion, so writes will always go into the buffer.\n\nAdjust the code to use a u32 internally and return -EOVERFLOW in the\noverflow case. The operation must be refused, because a DACL can only\nhold 2^16-1 bytes on the wire and larger DACLs cannot be represented.\n\nset_chmod_dacl() carries the same pattern and is fixed the same way. It\nonly wraps once the source DACL comes within roughly 380 bytes of the\n64K ceiling, but the failure mode is identical."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f5065508897a922327f32223082325d10b069ebc","lessThan":"284877c6189fda1ac3d81771dd8482660a0c7dc1","versionType":"git","status":"affected"},{"version":"f5065508897a922327f32223082325d10b069ebc","lessThan":"d433376abc47e10870ae732f89c7c1a60b199a0c","versionType":"git","status":"affected"},{"version":"f5065508897a922327f32223082325d10b069ebc","lessThan":"2ef532a01f44687f5b95001e88247cf05bff9892","versionType":"git","status":"affected"},{"version":"f5065508897a922327f32223082325d10b069ebc","lessThan":"ee13d687d06a6fbb2008625dd560c654231b28e0","versionType":"git","status":"affected"},{"version":"f5065508897a922327f32223082325d10b069ebc","lessThan":"d05045177a855386bca5e1909e08d06290e6e3b3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/284877c6189fda1ac3d81771dd8482660a0c7dc1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2ef532a01f44687f5b95001e88247cf05bff9892","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d05045177a855386bca5e1909e08d06290e6e3b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d433376abc47e10870ae732f89c7c1a60b199a0c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee13d687d06a6fbb2008625dd560c654231b28e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97560","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:06.537","lastModified":"2026-10-19T10:17:25.073","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix one-byte OOB read in smb2_parse_native_symlink()\n\nWhen parsing a share-root relative native symlink, memcpy copies\nsmb_target+1 (skipping the leading separator) but uses\nstrlen(smb_target)+1 as the length, reading one byte past the\nallocated buffer.\n\nThis fixes the following KASAN splat when accessing an SMB symlink\nwith a target of '\\a\\b':\n\n  BUG: KASAN: slab-out-of-bounds in smb2_parse_native_symlink+0x4f5/0xca0\n  Read of size 5 at addr ffff88800878fe21 by task netfsfuzz-execu/1\n  CPU: 1 UID: 0 PID: 1 Comm: netfsfuzz-execu Tainted: G N\n  7.2.0-11943-g2709dd5ae32f-dirty #1 PREEMPT(lazy)\n  Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix,\n  1996)\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x7b/0xa0\n   print_report+0xd0/0x630\n   kasan_report+0xe5/0x120\n   kasan_check_range+0x105/0x1b0\n   __asan_memcpy+0x23/0x60\n   smb2_parse_native_symlink+0x4f5/0xca0\n   parse_reparse_point+0x68a/0x1530\n   reparse_info_to_fattr+0x752/0xa20\n   cifs_get_fattr+0x873/0x15b0\n   cifs_get_inode_info+0xc0/0x310\n   cifs_lookup+0x308/0xa70\n   __lookup_slow+0x122/0x2b0\n   lookup_slow+0x50/0x70\n   path_lookupat+0x525/0xaf0\n   filename_lookup+0x1f2/0x550\n   vfs_statx+0xd1/0x1a0\n   vfs_fstatat+0x65/0xc0\n   __do_sys_newfstatat+0x9a/0x120\n   do_syscall_64+0xdd/0x4a0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/reparse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"430afd3edabf942a908570e5a41414bb455f15f8","lessThan":"ff411fcbfc55eec1d66ea82483d254319dc8e973","versionType":"git","status":"affected"},{"version":"fc5a409552be479715b147748f2f61b41b512976","lessThan":"22a9d0a9ba0c89be57558c1aa80dc60a571dd89c","versionType":"git","status":"affected"},{"version":"723f4ef90452aa629f3d923e92e0449d69362b1d","lessThan":"d1f173d28e964ba2c3c4ebe7491d594dc8c77a40","versionType":"git","status":"affected"},{"version":"723f4ef90452aa629f3d923e92e0449d69362b1d","lessThan":"2a302fdbaf7dd00d285303c94af8f48321c22993","versionType":"git","status":"affected"},{"version":"723f4ef90452aa629f3d923e92e0449d69362b1d","lessThan":"cb26524ef4ac28fcfa554c0656e8dc412c38a8ff","versionType":"git","status":"affected"},{"version":"c9280c017ea13ff8678ef4f1ea78a4b683292e8b","versionType":"git","status":"affected"},{"version":"6.6.64","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.12.2","lessThan":"6.12.111","versionType":"semver","status":"affected"},{"version":"6.11.11","lessThan":"6.12","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/reparse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/22a9d0a9ba0c89be57558c1aa80dc60a571dd89c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a302fdbaf7dd00d285303c94af8f48321c22993","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cb26524ef4ac28fcfa554c0656e8dc412c38a8ff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1f173d28e964ba2c3c4ebe7491d594dc8c77a40","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff411fcbfc55eec1d66ea82483d254319dc8e973","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97561","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:06.657","lastModified":"2026-10-21T13:21:13.787","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: honor forceuid/forcegid when mapping SIDs to uid/gid\n\nWhen the administrator mounts with forceuid or forcegid (uid=/gid=\nmount options), they expect all files to appear owned by the specified\nuser/group.  However, several code paths unconditionally called\nsid_to_id() to overwrite cf_uid/cf_gid with server-provided values,\nignoring the administrator's explicit override:\n\n  - smb311_posix_info_to_fattr() (stat via POSIX extensions)\n  - cifs_posix_to_fattr() (readdir via POSIX extensions)\n  - parse_sec_desc() (CIFS ACL ownership mapping)\n\nThis allowed an untrusted server to dictate local file ownership even\nwhen the mount was configured to force specific uid/gid values.\n\nFix all three call sites to check CIFS_MOUNT_OVERR_UID and\nCIFS_MOUNT_OVERR_GID before calling sid_to_id(), following the\nsame pattern already used by cifs_unix_basic_to_fattr() for unix\nextensions."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/cifsacl.c","fs/smb/client/inode.c","fs/smb/client/readdir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9409ae58e0759d010b347e7b19ebc90ab5d4b98f","lessThan":"be6eccccec867c22d7c65fab4ea4e91ec3d5b8c6","versionType":"git","status":"affected"},{"version":"9409ae58e0759d010b347e7b19ebc90ab5d4b98f","lessThan":"bc35de451c128d399ad185d6269f8847e97cd1c9","versionType":"git","status":"affected"},{"version":"9409ae58e0759d010b347e7b19ebc90ab5d4b98f","lessThan":"6ac7a29691558bed18e2df1780636b8aa0fd13d5","versionType":"git","status":"affected"},{"version":"9409ae58e0759d010b347e7b19ebc90ab5d4b98f","lessThan":"e1b74f8f8c1d13190b09fe623b729d36b7ac22a8","versionType":"git","status":"affected"},{"version":"9409ae58e0759d010b347e7b19ebc90ab5d4b98f","lessThan":"18a72975e9f35aadecc75b031f693f2d1f49308f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/cifsacl.c","fs/smb/client/inode.c","fs/smb/client/readdir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.0","status":"affected"},{"version":"0","lessThan":"3.0","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/18a72975e9f35aadecc75b031f693f2d1f49308f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ac7a29691558bed18e2df1780636b8aa0fd13d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc35de451c128d399ad185d6269f8847e97cd1c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be6eccccec867c22d7c65fab4ea4e91ec3d5b8c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e1b74f8f8c1d13190b09fe623b729d36b7ac22a8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97562","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:06.757","lastModified":"2026-10-19T10:17:25.280","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: pin DFS superblock in iterator callback\n\ntcon_super_cb() stores a raw superblock pointer, but __cifs_get_super()\ntakes its active reference only after iterate_supers_type() has dropped\ns_umount and its passive reference. Concurrent DFS automount expiry can\ntherefore free the superblock before cifs_sb_active() uses it.\n\nA deterministic KASAN test reproduces the race as:\n\n  BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80\n\nThe same test passes with this change applied.\n\nTake the active reference in the callback while iterate_supers_type()\nstill holds s_umount shared. cifs_put_tcp_super() remains the matching\nrelease."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bacd704a95ad0b93af995aae4a523aa046f46563","lessThan":"3c9acc9835c304013a4faeb969fe9333d66ca9f8","versionType":"git","status":"affected"},{"version":"bacd704a95ad0b93af995aae4a523aa046f46563","lessThan":"ea43a15cea36dc5ddd832be5bddeac7dd804cbcf","versionType":"git","status":"affected"},{"version":"bacd704a95ad0b93af995aae4a523aa046f46563","lessThan":"a6b6561522212af852c9ad8a7dca8d59ef2c7377","versionType":"git","status":"affected"},{"version":"bacd704a95ad0b93af995aae4a523aa046f46563","lessThan":"5b01a8c0209690db75341528ec53fd87e0ac1460","versionType":"git","status":"affected"},{"version":"bacd704a95ad0b93af995aae4a523aa046f46563","lessThan":"d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3c9acc9835c304013a4faeb969fe9333d66ca9f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5b01a8c0209690db75341528ec53fd87e0ac1460","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6b6561522212af852c9ad8a7dca8d59ef2c7377","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea43a15cea36dc5ddd832be5bddeac7dd804cbcf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97563","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:06.883","lastModified":"2026-10-19T10:17:25.407","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject out-of-bounds DataOffset in CIFSSMBRead()\n\nThe SMB1 synchronous read helper CIFSSMBRead() validates the server's\nDataLength against CIFSMaxBufSize and the caller's count, but never\nvalidates DataOffset. The copy source is formed as\n\n\t&pSMBr->hdr.Protocol + le16_to_cpu(pSMBr->DataOffset)\n\nand memcpy()'d for DataLength bytes with no check that the\n[DataOffset, DataOffset + DataLength) range lies within the response\nactually received from the server.\n\nA malicious or compromised SMB1 server can return a response carrying\nan in-range DataLength and a large DataOffset, driving the source\npointer past the end of the response buffer. The memcpy() then copies\nadjacent kernel heap into the caller's read buffer (information\ndisclosure), or reads unmapped memory and oopses (denial of service).\nSMB1 is not negotiated by default; reaching this code requires an\nexplicit vers=1.0 mount.\n\nBoth DataOffset and the received response length recorded in\nrsp_iov.iov_len are relative to the start of the SMB header, so reject\nthe response unless DataOffset + DataLength fits within that length,\nusing overflow-safe arithmetic, before forming the source pointer.\nThe response length has been validated by the previous patch, so the\nDataOffset and DataLength fields can be read safely here.\n\nWhile here, make data_length unsigned. It holds a length derived from\nunsigned on-the-wire fields and is only ever compared against unsigned\nquantities; print it with %u accordingly, and add __func__ to the\ncifs_dbg() calls in this function."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/cifssmb.c","fs/smb/client/trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"667feba13e78d16393aacb15869f70970f422227","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5be5bdda5863eacc964b609ba927764f253431b3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/cifssmb.c","fs/smb/client/trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5be5bdda5863eacc964b609ba927764f253431b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/667feba13e78d16393aacb15869f70970f422227","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97564","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:07.007","lastModified":"2026-10-19T10:17:25.503","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject userspace cifs.idmap descriptions\n\ncifs.idmap key descriptions carry authority-bearing fields (owner and\ngroup SIDs and uid/gid values in \"os:\"/\"gs:\"/\"oi:\"/\"gi:\" form) that the\ncifs.idmap upcall helper treats as kernel-originating inputs.  Unlike\nits sibling cifs.spnego, the cifs.idmap key type has no vet_description\nhook, so userspace can create keys of this type through\nrequest_key(2)/add_key(2) and supply those fields without CIFS origin.\nA request_key(2) call with a non-NULL callout then drives a root\nusermodehelper upcall (/sbin/request-key -> cifs.idmap) that consumes\nthe unvetted description in root context.\n\nOnly accept cifs.idmap descriptions while CIFS is using its private\nroot_cred to request the key.  id_to_sid()/sid_to_id() already run\nunder override_creds(root_cred), so the kernel-originated path is\nunaffected.\n\nThis mirrors commit 3da1fdf4efbc (\"smb: client: reject userspace\ncifs.spnego descriptions\"), which applied the same restriction to\ncifs.spnego."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4d79dba0e00749fa40de8ef13a9b85ce57a1603b","lessThan":"f29c1ec0e7d8c887a91df3f93bb4617c0ac95c6a","versionType":"git","status":"affected"},{"version":"4d79dba0e00749fa40de8ef13a9b85ce57a1603b","lessThan":"17c93bcd17755523c21abb22cbf2a41a6eb0caaf","versionType":"git","status":"affected"},{"version":"4d79dba0e00749fa40de8ef13a9b85ce57a1603b","lessThan":"e5964064e3fbe6325893408faff08ca33de0e2c3","versionType":"git","status":"affected"},{"version":"4d79dba0e00749fa40de8ef13a9b85ce57a1603b","lessThan":"96751028c0d4dec785709ea3eb0ab38a4f2ded96","versionType":"git","status":"affected"},{"version":"4d79dba0e00749fa40de8ef13a9b85ce57a1603b","lessThan":"1d3b24b16a0b013792e8f1e3ed060f0b46f537d1","versionType":"git","status":"affected"},{"version":"4d79dba0e00749fa40de8ef13a9b85ce57a1603b","lessThan":"d9d7eeb0cea5b55b82888f443622fd8d4ee064f3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.0","status":"affected"},{"version":"0","lessThan":"3.0","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/17c93bcd17755523c21abb22cbf2a41a6eb0caaf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1d3b24b16a0b013792e8f1e3ed060f0b46f537d1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96751028c0d4dec785709ea3eb0ab38a4f2ded96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9d7eeb0cea5b55b82888f443622fd8d4ee064f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e5964064e3fbe6325893408faff08ca33de0e2c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f29c1ec0e7d8c887a91df3f93bb4617c0ac95c6a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97565","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:07.127","lastModified":"2026-10-19T10:17:25.610","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject short READ responses in CIFSSMBRead()\n\nCIFSSMBRead() reads DataLengthHigh, DataLength and DataOffset out of\nthe READ_RSP returned by the server without first checking that a\nwhole READ_RSP was actually received. The length of the response is\nrecorded in rsp_iov.iov_len, but nothing constrains it to be at least\nread_rsp_size before those fields are dereferenced.\n\nA malicious or compromised SMB1 server can return a response shorter\nthan the READ_RSP header, so that parsing the header itself reads past\nthe end of the receive buffer. SMB1 is not negotiated by default;\nreaching this code requires an explicit vers=1.0 mount.\n\nReject the response unless it is at least read_rsp_size bytes long."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/cifssmb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"0f1f77b821506a4dacab6ce7d29cf9e0c26f14cd","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"aaa221c1b1d288845b55e9c366e5ef608dfff49d","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e6142a8bfc230c7263eb8b0475249c958ce49367","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/cifssmb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0f1f77b821506a4dacab6ce7d29cf9e0c26f14cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aaa221c1b1d288845b55e9c366e5ef608dfff49d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6142a8bfc230c7263eb8b0475249c958ce49367","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97566","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:07.233","lastModified":"2026-10-21T13:21:13.907","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: kernel: drop pending ADD_ADDR when removing ID0\n\nThe in-kernel MPTCP path manager can leave a stale ADD_ADDR announcement\nentry alive when removing the id 0 endpoint. This happens because the id 0\nremoval path does not tear down pending announcements, unlike the non-zero\nid path.\n\nWhen the PM later reselects id 0 after adding another signal endpoint, it\nfinds the stale anno_list entry and hits WARN_ON_ONCE(mptcp_pm_is_kernel())\nin mptcp_pm_announced_alloc().\n\nRoot cause: asymmetry between removal paths.\n- Non-zero id path: mptcp_nl_remove_subflow_and_signal_addr() calls\n  mptcp_pm_remove_announced() to clean up.\n- Id 0 path: mptcp_nl_remove_id_zero_address() skips cleanup entirely.\n\nFix by making the id 0 path symmetric: call mptcp_pm_announced_remove()\nand decrement add_addr_signaled before queuing the RM_ADDR.\n\nSubtle detail: signal endpoints are stored in anno_list with port 0, but\nmsk_local carries the connection's local port. In other words, entries\nlinked to ID0 paths should have port == 0. A follow-up patch will ensure\nthat. mptcp_pm_announced_remove() uses use_port=true for comparison. So\nclear the port before the lookup."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mptcp/pm_kernel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"740d798e8767d8a449902b1a1bbc70facfce19b5","lessThan":"189d60057e5f3d6a62e3d71a3cc428c9150bc14f","versionType":"git","status":"affected"},{"version":"740d798e8767d8a449902b1a1bbc70facfce19b5","lessThan":"bacf23e7c9876c9f4170166b3597cb22ea3ed39b","versionType":"git","status":"affected"},{"version":"740d798e8767d8a449902b1a1bbc70facfce19b5","lessThan":"d4a67a880654e1bfe318a31bea0bdbb026a09ade","versionType":"git","status":"affected"},{"version":"740d798e8767d8a449902b1a1bbc70facfce19b5","lessThan":"545616b4e7325be3c61fc082538cb06d14f7b1db","versionType":"git","status":"affected"},{"version":"740d798e8767d8a449902b1a1bbc70facfce19b5","lessThan":"2ac7d6e620764f1fc79eb4edd3610a7a661981ca","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mptcp/pm_kernel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/189d60057e5f3d6a62e3d71a3cc428c9150bc14f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2ac7d6e620764f1fc79eb4edd3610a7a661981ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/545616b4e7325be3c61fc082538cb06d14f7b1db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bacf23e7c9876c9f4170166b3597cb22ea3ed39b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d4a67a880654e1bfe318a31bea0bdbb026a09ade","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97567","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:07.343","lastModified":"2026-10-21T13:21:14.043","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: prevent race between disconnect() and rtx\n\nSashiko noted that the two event can race, leading to inconsistent\nstatus. Prevent the race using the synchronous timer stop operation."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mptcp/protocol.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b29fcfb54cd70caca5b11c80d8d238854938884a","lessThan":"75b3b30ae4ee6aa0572595f6b48544ed4f479eb6","versionType":"git","status":"affected"},{"version":"b29fcfb54cd70caca5b11c80d8d238854938884a","lessThan":"2261f857ef4e0d21eb1a8b47b06640cf7ab16d3e","versionType":"git","status":"affected"},{"version":"b29fcfb54cd70caca5b11c80d8d238854938884a","lessThan":"374da2b9be1280695ce41f108334a8f16e3e54be","versionType":"git","status":"affected"},{"version":"b29fcfb54cd70caca5b11c80d8d238854938884a","lessThan":"69a7b2a912672159dda7dcf325d27752d448dfdf","versionType":"git","status":"affected"},{"version":"b29fcfb54cd70caca5b11c80d8d238854938884a","lessThan":"85c580b0d8590520ae00a15c29e9fb9c99427a3e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mptcp/protocol.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.17","status":"affected"},{"version":"0","lessThan":"5.17","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.113","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2261f857ef4e0d21eb1a8b47b06640cf7ab16d3e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/374da2b9be1280695ce41f108334a8f16e3e54be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/69a7b2a912672159dda7dcf325d27752d448dfdf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/75b3b30ae4ee6aa0572595f6b48544ed4f479eb6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/85c580b0d8590520ae00a15c29e9fb9c99427a3e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97568","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:07.453","lastModified":"2026-10-19T10:17:25.907","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: syncookies: remember the request backup flag\n\nInstead of using an uninitialised bit when copying the info in\nsubflow_ulp_clone().\n\nTo fix this, no need to extend the join_entry structure: backup is\ncoming from struct mptcp_subflow_request_sock, only one bit. Do the same\nhere by using one bit for both."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mptcp/syncookies.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1008f2bcbc8e461c1df3aebba30ac4f616ebe570","lessThan":"c97fa2c7ada82d4cac1c6c00643238dc4c462f15","versionType":"git","status":"affected"},{"version":"6f01f41b6a492ddf2da7609967cfaf57e7ca48a7","lessThan":"1668b34452009d27be3262646de748a3e48ffd51","versionType":"git","status":"affected"},{"version":"09176f80995105c62939728fbad5c437d61e7ff4","lessThan":"b138e7dc719f0a3949de8bb6500b8cf1604eea06","versionType":"git","status":"affected"},{"version":"8ed3e34c766e8264d5d2e0436f86c51604d6a8a7","lessThan":"360d99258a6402cb8e49771460944f19f04d25b7","versionType":"git","status":"affected"},{"version":"efd340bf3d7779a3a8ec954d8ec0fb8a10f24982","lessThan":"61178d0b85b4b1b53e78b06e89d018d22d102f88","versionType":"git","status":"affected"},{"version":"efd340bf3d7779a3a8ec954d8ec0fb8a10f24982","lessThan":"00b2bd518911e0daab00f4749cce68c191ccebb4","versionType":"git","status":"affected"},{"version":"efd340bf3d7779a3a8ec954d8ec0fb8a10f24982","lessThan":"06d649f9cd03a9f8e768a658b20acf8d2c8022e0","versionType":"git","status":"affected"},{"version":"efd340bf3d7779a3a8ec954d8ec0fb8a10f24982","lessThan":"b76c0e28b392620dfbaf92cdeedbf115820b44cb","versionType":"git","status":"affected"},{"version":"73e2baa301ee3f62ff971e68877adeb37f98cc67","versionType":"git","status":"affected"},{"version":"5.10.224","lessThan":"5.10.271","versionType":"semver","status":"affected"},{"version":"5.15.165","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"6.1.104","lessThan":"6.1.189","versionType":"semver","status":"affected"},{"version":"6.6.45","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.10.4","lessThan":"6.11","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mptcp/syncookies.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/00b2bd518911e0daab00f4749cce68c191ccebb4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/06d649f9cd03a9f8e768a658b20acf8d2c8022e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1668b34452009d27be3262646de748a3e48ffd51","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/360d99258a6402cb8e49771460944f19f04d25b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61178d0b85b4b1b53e78b06e89d018d22d102f88","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b138e7dc719f0a3949de8bb6500b8cf1604eea06","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b76c0e28b392620dfbaf92cdeedbf115820b44cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c97fa2c7ada82d4cac1c6c00643238dc4c462f15","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97569","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:07.570","lastModified":"2026-10-19T10:17:26.020","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Prevent queue stop with deferred completions\n\nWhen the driver receives a burst of packets, it can mark a BD with the\nNO_CMPL bit to defer completions. The expectation is that the last\npacket in the ring will have this bit unset and the completion generated\nby that packet will cleanup that packet and the ones preceding it. This\nhelps to reduce the number of completions fired.\n\nThe suppressed completions are controlled by the driver and the number\nof packets with suppressed completions scales with the size of the ring.\nSW USO packets, on the other hand, have an upper bound on the maximum\nnumber of BDs which can be consumed which does not scale with the ring\nsize.\n\nSo, for small rings it is possible that: a burst of packets is handed to\nthe driver, the driver defers completions for all of the packets because\nthe number of free descriptors stays above the threshold in the driver.\nThen, a USO packet arrives, but the number of BDs available is not\nenough and the USO code exits early.\n\nIn this case, you end up in a state where the ring is full of packets\nwith their completions suppressed, which can cause the queue to stop and\nnever be restarted.\n\nAssuming default CONFIG_MAX_SKB_FRAGS, this is only possible for small\nrings (<= 457 descriptors, below the driver default value) when\na burst of packets fills the ring, followed by a large USO packet that\ncan't fit. For larger rings, the delta between the completion\nsuppression threshold and the BDs required for SW USO is large enough\nthat completions will fire and this case is unreachable.\n\nThis issue was pointed out by Sashiko and while it seems fairly unlikely\ngiven that the queue size must be small to trigger this, it is indeed\npossible.\n\nFix this by tracking the last BD which deferred completions and\ncentralizing the logic for deciding when to ring the doorbell. The NO_CMPL\nbit is now cleared in bnxt_txr_db_kick(), so every doorbell site is\ncovered, including the SW USO early exit. This guarantees the ring always\nends in a BD which generates a completion to clean it and wake the queue."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c","drivers/net/ethernet/broadcom/bnxt/bnxt.h","drivers/net/ethernet/broadcom/bnxt/bnxt_gso.c","drivers/net/ethernet/broadcom/bnxt/bnxt_gso.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cc5d90667db81474ed7a92a1b2fa3daec5559307","lessThan":"e33ce547c0cd40738d6bad23e5fc0539ee3e8f7d","versionType":"git","status":"affected"},{"version":"cc5d90667db81474ed7a92a1b2fa3daec5559307","lessThan":"39b23c1c40e1f73d2b94a09282cc476af647e438","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c","drivers/net/ethernet/broadcom/bnxt/bnxt.h","drivers/net/ethernet/broadcom/bnxt/bnxt_gso.c","drivers/net/ethernet/broadcom/bnxt/bnxt_gso.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/39b23c1c40e1f73d2b94a09282cc476af647e438","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e33ce547c0cd40738d6bad23e5fc0539ee3e8f7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97570","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:07.683","lastModified":"2026-10-19T10:17:26.120","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Bound SW TPA IDs to prevent crashes\n\nFW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range\n0..1023 (see commit ec4d8e7cf024 (\"bnxt_en: Add TPA ID mapping logic for\n57500 chips.\")). bnxt_alloc_agg_idx is intended to wrap the FW ID down to a\nsoftware ID which is used to index rxr->rx_tpa, and to generate a mapping\nbetween FW IDs and the wrapped software ID.\n\nOn a 57608 with firmware version 233, the firmware advertises 32\nconcurrent TPAs. As of the commit under fixes, bp->max_tpa on this NIC\nis set to 32.\n\nIf the software ID from bnxt_alloc_agg_idx is above 31, this results in\nan invalid address being loaded on this line:\n\n  tpa_info = &rxr->rx_tpa[agg_id];\n\nbecause rx_tpa is allocated with only bp->max_tpa (32) entries. Writes\nto tpa_info later in the code are out of bounds.\n\nThis bug results in a crash at boot:\n\nOops: general protection fault, kernel NULL pointer dereference 0x8: 0000 [#1] SMP NOPTI\nRIP: 0010:bnxt_rx_pkt+0xc0/0x1560\nRSP: 0018:ffffc900009b8c78 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000048 RCX: 0000000206682516\nRDX: ffffc900009b8db4 RSI: 0000000000000000 RDI: 01ffffff038fe1c0\nRBP: ffffc9006e687480 R08: ffffc9006e687000 R09: 0000000000003048\nR10: 0000000000000480 R11: ffff8881c6083900 R12: 0000000006682516\nR13: ffff8881c6095400 R14: 0000000000000016 R15: ffff8881c6b66680\nFS:  0000000000000000(0000) GS:ffff88fef3c77000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fc8bda40584 CR3: 000000807c812001 CR4: 0000000008772ef0\nPKRU: 55555554\nCall Trace:\n <IRQ>\n ? __netif_receive_skb_list_core+0x1ca/0x250\n __bnxt_poll_work+0x152/0x280\n bnxt_poll_p5+0x1cd/0x480\n __napi_poll+0x30/0x180\n net_rx_action+0x20b/0x3b0\n ? note_gp_changes+0x53/0xe0\n ? tick_setup_sched_timer+0x180/0x180\n ? __napi_schedule+0x9a/0xb0\n ? bnxt_msix+0x24/0x30\n handle_softirqs+0xdd/0x2c0\n __irq_exit_rcu.llvm.3171231171502365008+0x47/0xf0\n common_interrupt+0x85/0x90\n </IRQ>\n <TASK>\n asm_common_interrupt+0x22/0x40\n\nThis stack trace is from a crash triggered when an out of bounds rx_tpa\nis dereferenced. The invalid write mentioned above is silent in this\nparticular crash.\n\nFix this by allocating rx_tpa with bp->max_tpa rounded up to the next\npower of 2 (bp->max_tpa_roundup_size) entries and masking the FW TPA ID\nwith that size, so the wrapped ID can never index past the end of the\narray."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c","drivers/net/ethernet/broadcom/bnxt/bnxt.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"54c28fab2fa5afd681c9c4b10f4f6da1efdd397a","lessThan":"05cf64d171772c65bcdee76ee7163c35d9f55a89","versionType":"git","status":"affected"},{"version":"54c28fab2fa5afd681c9c4b10f4f6da1efdd397a","lessThan":"c0aceaf65b70b3c000e70dd867f3a673015f24ca","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c","drivers/net/ethernet/broadcom/bnxt/bnxt.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/05cf64d171772c65bcdee76ee7163c35d9f55a89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0aceaf65b70b3c000e70dd867f3a673015f24ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97571","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:07.803","lastModified":"2026-10-19T10:17:26.243","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()\n\nbnxt_alloc_one_tpa_info_data() returns -ENOMEM as soon as one allocation\nfails. This leaves the remaining rxr->rx_tpa[] entries zeroed.\n\nbnxt_queue_mem_alloc() discards that return value, so the partially\ninitialized ring is installed by bnxt_queue_start().\n\nSince the agg_id is picked by the hardware and bnxt_alloc_agg_idx maps\nit to a SW index in rxr->rx_tpa[], it is possible that an uninitialized\nslot can be chosen which would hand a zero DMA address to the device.\n\nFix this by checking the return value of bnxt_alloc_one_tpa_info_data\nand unwinding, freeing the ring buffers."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0997443906b96a051011f220a61e6dce4602ec54","lessThan":"d7db2e4953e4626339fd0075564a3e447650d37b","versionType":"git","status":"affected"},{"version":"bd649c5cc958169b8a8a3e77ea926d92d472b02a","lessThan":"c8050386a2209b2a474c1eb4bd1574dc19129bfb","versionType":"git","status":"affected"},{"version":"bd649c5cc958169b8a8a3e77ea926d92d472b02a","lessThan":"37e08dc821a57fe0592c917486b638caa888b46d","versionType":"git","status":"affected"},{"version":"bd649c5cc958169b8a8a3e77ea926d92d472b02a","lessThan":"b814dfbfeb0a68c9a52073f2caa05a2d5247a329","versionType":"git","status":"affected"},{"version":"6.12.20","lessThan":"6.12.112","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/37e08dc821a57fe0592c917486b638caa888b46d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b814dfbfeb0a68c9a52073f2caa05a2d5247a329","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c8050386a2209b2a474c1eb4bd1574dc19129bfb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7db2e4953e4626339fd0075564a3e447650d37b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97572","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:07.910","lastModified":"2026-10-19T10:17:26.347","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Propagate RX ring init failures in bnxt_init_nic()\n\nbnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring()\nfails, but bnxt_init_nic() discards that return value and calls\nbnxt_init_chip(), which enables TPA.\n\nIf an allocation fails, this could leave rxr->rx_tpa[] partially zeroed\nand TPA would be enabled over an array with zeroed entries. This would\nlead to a zeroed DMA address being handed out if the agg_idx is\ntranslated to a SW index at a zeroed entry.\n\nFix this by propagating the error out of bnxt_init_nic(). Both callers\nalready check its return value and unwind with bnxt_free_skbs() and\nbnxt_free_mem(), which tolerate a partially initialized RX ring."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c0c050c58d840994ba842ad1c338a98e7c12b764","lessThan":"e40641638743b4b848d5ed78a0565afffc359d8e","versionType":"git","status":"affected"},{"version":"c0c050c58d840994ba842ad1c338a98e7c12b764","lessThan":"6b24eca42619b93f69aebc2aa0a9fd28ac9a5085","versionType":"git","status":"affected"},{"version":"c0c050c58d840994ba842ad1c338a98e7c12b764","lessThan":"1f2d333ae2e1a73b7cc1c2a627587024cd147c01","versionType":"git","status":"affected"},{"version":"c0c050c58d840994ba842ad1c338a98e7c12b764","lessThan":"c3eb07e78e628243cbb9bbb0115db802fb7a303f","versionType":"git","status":"affected"},{"version":"c0c050c58d840994ba842ad1c338a98e7c12b764","lessThan":"daadccd062fdca5e77a8cc22ffe35857803b6c49","versionType":"git","status":"affected"},{"version":"c0c050c58d840994ba842ad1c338a98e7c12b764","lessThan":"b4c40f2c80d7bf50648878bc206a39adfbfaec6c","versionType":"git","status":"affected"},{"version":"c0c050c58d840994ba842ad1c338a98e7c12b764","lessThan":"dfd73af81cdb9f7b399754a59e2658a08211bee5","versionType":"git","status":"affected"},{"version":"c0c050c58d840994ba842ad1c338a98e7c12b764","lessThan":"8e6a850c0746bb4be167aedf1ee57469fcda09a9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.4","status":"affected"},{"version":"0","lessThan":"4.4","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1f2d333ae2e1a73b7cc1c2a627587024cd147c01","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b24eca42619b93f69aebc2aa0a9fd28ac9a5085","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e6a850c0746bb4be167aedf1ee57469fcda09a9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b4c40f2c80d7bf50648878bc206a39adfbfaec6c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3eb07e78e628243cbb9bbb0115db802fb7a303f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/daadccd062fdca5e77a8cc22ffe35857803b6c49","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dfd73af81cdb9f7b399754a59e2658a08211bee5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e40641638743b4b848d5ed78a0565afffc359d8e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97573","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:08.017","lastModified":"2026-10-19T10:17:26.470","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()\n\nbnxt_rx_ring_reset() frees the ring buffers and then reallocates them,\nignoring the result.\n\nbnxt_alloc_one_rx_ring() can fail in bnxt_alloc_one_tpa_info_data(), which\nreturns -ENOMEM on the first failed allocation and leaves the remaining\nrxr->rx_tpa[] entries zeroed.\n\nThe error isn't propagated up, so the loop in bnxt_rx_ring_reset\ncontinues and at the end the code re-enables TPA with partially\nunallocated rx_tpa array.\n\nThis means that when the agg_id from hardware is mapped to a SW index in\nrxr->rx_tpa[], an uninitialized slot can be chosen which would hand a\nzero DMA address to the device.\n\nFix this by falling back to a global reset, which is what the existing\ncode already does when other functions fail, but unlike the other\nfailure cases this particular failure has to return because TPA can't\nbe re-enabled since the allocation failed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8fbf58e17dce8f250dda9ad6b0a49b3041f0af14","lessThan":"52fc97cbc3ba118aad84e7c001bf02ebe8496f70","versionType":"git","status":"affected"},{"version":"8fbf58e17dce8f250dda9ad6b0a49b3041f0af14","lessThan":"40b4a7bb6b0b872b45f017dbf211268de098b75c","versionType":"git","status":"affected"},{"version":"8fbf58e17dce8f250dda9ad6b0a49b3041f0af14","lessThan":"af9a2bdaba0b4ceb0fc5e5122ef3fc6b7e5a366a","versionType":"git","status":"affected"},{"version":"8fbf58e17dce8f250dda9ad6b0a49b3041f0af14","lessThan":"cfec9e7f15a56cb0104bac13d01e5d11e1ba84fb","versionType":"git","status":"affected"},{"version":"8fbf58e17dce8f250dda9ad6b0a49b3041f0af14","lessThan":"1a3670b6a6b5679fe56c5890157b344f091e64f8","versionType":"git","status":"affected"},{"version":"8fbf58e17dce8f250dda9ad6b0a49b3041f0af14","lessThan":"4a17c73c83798c2fa9c7920ad5a98803adce3e01","versionType":"git","status":"affected"},{"version":"8fbf58e17dce8f250dda9ad6b0a49b3041f0af14","lessThan":"8b2fd5c0aeda935294159206af9d6179282d425a","versionType":"git","status":"affected"},{"version":"8fbf58e17dce8f250dda9ad6b0a49b3041f0af14","lessThan":"961e2a17c5e3559b3f8654d2daabdd25a42e770a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1a3670b6a6b5679fe56c5890157b344f091e64f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/40b4a7bb6b0b872b45f017dbf211268de098b75c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a17c73c83798c2fa9c7920ad5a98803adce3e01","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/52fc97cbc3ba118aad84e7c001bf02ebe8496f70","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b2fd5c0aeda935294159206af9d6179282d425a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/961e2a17c5e3559b3f8654d2daabdd25a42e770a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af9a2bdaba0b4ceb0fc5e5122ef3fc6b7e5a366a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfec9e7f15a56cb0104bac13d01e5d11e1ba84fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97574","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:08.127","lastModified":"2026-10-19T10:17:26.613","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Don't free the live ring's TPA state on queue restart failure\n\nbnxt_queue_mem_alloc() shallow copies the live RX ring into the clone:\n\n  memcpy(clone, rxr, sizeof(*rxr));\n\nthe code currently clears pointers that the clone owns (such as\nrx_agg_bmap), but rx_tpa and rx_tpa_idx_map are left pointing at memory\nof the live ring that was cloned.\n\nIf an allocation failure happens later and the err_free_tpa_info label\nis taken, the live ring's memory can be freed while still in use.\n\nFix this by initializing the clone's pointers to NULL to prevent live\nring state from being freed inadvertently."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0997443906b96a051011f220a61e6dce4602ec54","lessThan":"e42287b4d38d653f7d4a47f6c29b0c01288bb050","versionType":"git","status":"affected"},{"version":"bd649c5cc958169b8a8a3e77ea926d92d472b02a","lessThan":"8ade95619cbfd1fc57f0f1a9a5ebdca2345a8d27","versionType":"git","status":"affected"},{"version":"bd649c5cc958169b8a8a3e77ea926d92d472b02a","lessThan":"0596a7caa6fc283e142716739099c038d8714082","versionType":"git","status":"affected"},{"version":"bd649c5cc958169b8a8a3e77ea926d92d472b02a","lessThan":"5ce7f36c334d723954855ac769ede2fe0e8f89c8","versionType":"git","status":"affected"},{"version":"6.12.20","lessThan":"6.12.112","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0596a7caa6fc283e142716739099c038d8714082","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ce7f36c334d723954855ac769ede2fe0e8f89c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8ade95619cbfd1fc57f0f1a9a5ebdca2345a8d27","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e42287b4d38d653f7d4a47f6c29b0c01288bb050","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97575","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:08.230","lastModified":"2026-10-19T10:17:26.710","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-ctrls: validate AV1 tile counts\n\nThe stateless AV1 decoders use tile_info.tile_cols and tile_rows as loop\nbounds and as indices into the mi_*_starts[] and *_in_sbs_minus_1[]\narrays, as the divisor for context_update_tile_id, and their product\nbounds the per-tile descriptor buffers, but std_validate_compound() does\nnot bound these u8 fields. Reject a V4L2_CTRL_TYPE_AV1_FRAME whose\ntile_cols or tile_rows exceeds V4L2_AV1_MAX_TILE_COLS / _ROWS, or whose\nproduct exceeds V4L2_AV1_MAX_TILE_COUNT. A zero tile count is left to the\nconsuming driver so the zero-initialised control that existing userspace\nsubmits is still accepted."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/media/v4l2-core/v4l2-ctrls-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9de30f579980b498606a9c2440b73ae3b670771b","lessThan":"1afaf85c4990fb1e3168d0d6e99246a65e526f1b","versionType":"git","status":"affected"},{"version":"9de30f579980b498606a9c2440b73ae3b670771b","lessThan":"85df9fc79b07f1cc7c953f930ae7e675d0c1e820","versionType":"git","status":"affected"},{"version":"9de30f579980b498606a9c2440b73ae3b670771b","lessThan":"c8891da0186fe4c04bccbbd7d84b01a3c941ac7a","versionType":"git","status":"affected"},{"version":"9de30f579980b498606a9c2440b73ae3b670771b","lessThan":"c4c88b5ba85685043d171e0e9c9d00a8cf6a89e8","versionType":"git","status":"affected"},{"version":"9de30f579980b498606a9c2440b73ae3b670771b","lessThan":"439058ced617fbb3febc017b9e93bb7387f309e0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/media/v4l2-core/v4l2-ctrls-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1afaf85c4990fb1e3168d0d6e99246a65e526f1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/439058ced617fbb3febc017b9e93bb7387f309e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/85df9fc79b07f1cc7c953f930ae7e675d0c1e820","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4c88b5ba85685043d171e0e9c9d00a8cf6a89e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c8891da0186fe4c04bccbbd7d84b01a3c941ac7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97576","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:08.340","lastModified":"2026-10-19T10:17:26.840","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-ctrls: validate HEVC tile counts\n\nThe stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from\ncolumn_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[]\nand use them as tile-loop bounds, but std_validate_compound() does not\nbound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling\nenabled whose tile counts exceed the uAPI array capacity, mirroring the\nexisting compound-control range checks."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/media/v4l2-core/v4l2-ctrls-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"256fa3920874b0f1f4cb79ad6766493a22187153","lessThan":"9c0a718e24d4cd6d975f3df9740f968f62891a20","versionType":"git","status":"affected"},{"version":"256fa3920874b0f1f4cb79ad6766493a22187153","lessThan":"975e0180488966bb709092a52408604bd4f4edd9","versionType":"git","status":"affected"},{"version":"256fa3920874b0f1f4cb79ad6766493a22187153","lessThan":"724915535558b14c111ad8a498b896026dfe8d20","versionType":"git","status":"affected"},{"version":"256fa3920874b0f1f4cb79ad6766493a22187153","lessThan":"400cd78a63cc647412cf069c9851bdea2818340c","versionType":"git","status":"affected"},{"version":"256fa3920874b0f1f4cb79ad6766493a22187153","lessThan":"c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34","versionType":"git","status":"affected"},{"version":"256fa3920874b0f1f4cb79ad6766493a22187153","lessThan":"ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f","versionType":"git","status":"affected"},{"version":"256fa3920874b0f1f4cb79ad6766493a22187153","lessThan":"dc694a9929f7cb9c88ef91e45eb982b7bbe5a477","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/media/v4l2-core/v4l2-ctrls-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.5","status":"affected"},{"version":"0","lessThan":"5.5","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/400cd78a63cc647412cf069c9851bdea2818340c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/724915535558b14c111ad8a498b896026dfe8d20","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/975e0180488966bb709092a52408604bd4f4edd9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c0a718e24d4cd6d975f3df9740f968f62891a20","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc694a9929f7cb9c88ef91e45eb982b7bbe5a477","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97577","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:08.447","lastModified":"2026-10-19T10:17:26.973","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity\n\nrockchip_vpu981_av1_dec_set_tile_info() indexes the tile group entry\narray by tile1 * tile_cols + tile0, reading up to tile_cols * tile_rows\nentries, lays out one descriptor per tile in the AV1_MAX_TILES tile_info\nbuffer, and programs the real tile_cols / tile_rows into the hardware.\n\nThe tile group entry control is a dynamic array sized to the number of\nentries userspace submitted, independent of tile_cols / tile_rows, so a\nframe that claims more tiles than entries reads past the array. A frame\nthat claims more than AV1_MAX_TILES tiles also leaves the hardware\nprogrammed for more tiles than the descriptor buffer holds.\n\nReject both in prepare_run(): tile_cols * tile_rows must not exceed the\nsubmitted entry count or AV1_MAX_TILES. The entry count is read via\nv4l2_ctrl_find() (ctrl->elems). This mirrors the bound the mediatek AV1\ndecoder already enforces."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"727a400686a2c0d25015c9e44916a59b72882f83","lessThan":"95ee48eb17c91bd4859b65e0a54e7722f370d0e5","versionType":"git","status":"affected"},{"version":"727a400686a2c0d25015c9e44916a59b72882f83","lessThan":"40029f7f35397853f8711d6fce1d90a4c7a01f8c","versionType":"git","status":"affected"},{"version":"727a400686a2c0d25015c9e44916a59b72882f83","lessThan":"a41babf528f70c9a82ed31cfb5fe19065910f7f0","versionType":"git","status":"affected"},{"version":"727a400686a2c0d25015c9e44916a59b72882f83","lessThan":"fd965369220cc160bb20a24991790814bfbab401","versionType":"git","status":"affected"},{"version":"727a400686a2c0d25015c9e44916a59b72882f83","lessThan":"367db8b23c26a913d76ed70457bbcd781c422b49","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/367db8b23c26a913d76ed70457bbcd781c422b49","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/40029f7f35397853f8711d6fce1d90a4c7a01f8c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/95ee48eb17c91bd4859b65e0a54e7722f370d0e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a41babf528f70c9a82ed31cfb5fe19065910f7f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd965369220cc160bb20a24991790814bfbab401","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97578","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:08.567","lastModified":"2026-10-19T10:17:27.100","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer\n\nrockchip_vpu981_av1_dec_set_tile_info() divides context_update_tile_id by\ntile_info->tile_cols and writes one descriptor per tile into the tile_info\nDMA buffer, which holds AV1_MAX_TILES entries; tile_cols and tile_rows\ncome from the bitstream. Guard the division against a zero tile_cols by\ninitialising the context-update values to zero and computing them only\nwhen tile_cols is non-zero, and stop the descriptor writes once the\ntile_info buffer is full. The tile geometry written to the hardware\nregisters is left unmodified; the per-dimension and total tile bounds are\nenforced by the control validation."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"727a400686a2c0d25015c9e44916a59b72882f83","lessThan":"8659e5fc21a82e00fb2db1557f2e06f0fca06b90","versionType":"git","status":"affected"},{"version":"727a400686a2c0d25015c9e44916a59b72882f83","lessThan":"7baa7bb1b784c19170df8c99466fa412040eb431","versionType":"git","status":"affected"},{"version":"727a400686a2c0d25015c9e44916a59b72882f83","lessThan":"8f19d869a9f6800547c9ad7ebaf3b94f973dab50","versionType":"git","status":"affected"},{"version":"727a400686a2c0d25015c9e44916a59b72882f83","lessThan":"6b7a281a815ae7c5e7bb2aad039ffea9bc933157","versionType":"git","status":"affected"},{"version":"727a400686a2c0d25015c9e44916a59b72882f83","lessThan":"b84f6533a8ed2fd7b282fc7ab4b8efadc745a89c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/6b7a281a815ae7c5e7bb2aad039ffea9bc933157","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7baa7bb1b784c19170df8c99466fa412040eb431","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8659e5fc21a82e00fb2db1557f2e06f0fca06b90","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f19d869a9f6800547c9ad7ebaf3b94f973dab50","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b84f6533a8ed2fd7b282fc7ab4b8efadc745a89c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97579","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:08.677","lastModified":"2026-10-19T10:17:27.220","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: bound AV1 tile-start copy to the array capacity\n\nvdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries\ninto mi_col_starts[] / mi_row_starts[] from the bitstream tile_info. Bound\nthe copy to the array capacity."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_av1_req_lat_if.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0934d37596151edce115c6d0843a9ad7d5e5d232","lessThan":"f19acf00818a9eada06a77715d0188c181fb435e","versionType":"git","status":"affected"},{"version":"0934d37596151edce115c6d0843a9ad7d5e5d232","lessThan":"ad47a250afafa3a51cfb4a004463ff28e66c596e","versionType":"git","status":"affected"},{"version":"0934d37596151edce115c6d0843a9ad7d5e5d232","lessThan":"7992059c045780095ba5a696dcb2f5400a82803c","versionType":"git","status":"affected"},{"version":"0934d37596151edce115c6d0843a9ad7d5e5d232","lessThan":"eb0ea3898e3921900939e30c3946dd2b52281859","versionType":"git","status":"affected"},{"version":"0934d37596151edce115c6d0843a9ad7d5e5d232","lessThan":"37bef2170d4c88fc3d708eecf3ef0f4032bc1372","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_av1_req_lat_if.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/37bef2170d4c88fc3d708eecf3ef0f4032bc1372","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7992059c045780095ba5a696dcb2f5400a82803c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad47a250afafa3a51cfb4a004463ff28e66c596e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb0ea3898e3921900939e30c3946dd2b52281859","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f19acf00818a9eada06a77715d0188c181fb435e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97580","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:08.790","lastModified":"2026-10-19T10:17:27.333","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rkvdec: bound HEVC tile loops and PPS id to the array capacity\n\ncompute_tiles_uniform() and compute_tiles_non_uniform() loop over\nnum_tile_columns_minus1 + 1 / num_tile_rows_minus1 + 1 entries, and\nassemble_hw_pps() writes one COLUMN_WIDTH / ROW_HEIGHT register per tile\nand indexes priv_tbl->param_set[] by pic_parameter_set_id, all taken from\nthe untrusted PPS. Use the bounded v4l2_hevc_pps_num_tile_columns() /\nv4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bail out of\nassemble_hw_pps() before indexing priv_tbl->param_set[] with an\nout-of-range pic_parameter_set_id, so the writes stay within the hardware\ntables."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c","drivers/media/platform/rockchip/rkvdec/rkvdec-hevc.c","drivers/media/platform/rockchip/rkvdec/rkvdec-vdpu381-hevc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3595375c2301653d5440d54b396df03499686c20","lessThan":"03beb248d8a7bab30559a60d4df81f167e63b9e3","versionType":"git","status":"affected"},{"version":"3595375c2301653d5440d54b396df03499686c20","lessThan":"81ad46bb33d8fd279aaa33af5296c648814c964b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c","drivers/media/platform/rockchip/rkvdec/rkvdec-hevc.c","drivers/media/platform/rockchip/rkvdec/rkvdec-vdpu381-hevc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/03beb248d8a7bab30559a60d4df81f167e63b9e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81ad46bb33d8fd279aaa33af5296c648814c964b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97581","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:08.897","lastModified":"2026-10-19T10:17:27.440","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity\n\nprepare_tile_info_buffer() writes one entry per tile into the tile_sizes\nDMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the\nbounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows()\nhelpers so the loops stay inside the buffer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c","lessThan":"6d192fc0d6faff25ecf6d52cbde4b939cb12c192","versionType":"git","status":"affected"},{"version":"cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c","lessThan":"2887a98c03d97a6fcb6c2dab92956f2f4c402cdd","versionType":"git","status":"affected"},{"version":"cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c","lessThan":"62ae24639d22909a5724627a0467e4bde9704020","versionType":"git","status":"affected"},{"version":"cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c","lessThan":"4f654c9bc954569ff9b8ab860b29480c4cf6f57b","versionType":"git","status":"affected"},{"version":"cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c","lessThan":"05e8e4cdfe692f5cedba9aa9d7b8f2584cf926c8","versionType":"git","status":"affected"},{"version":"cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c","lessThan":"06236b094c899c22c12ac5097935eb6719293de8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/05e8e4cdfe692f5cedba9aa9d7b8f2584cf926c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/06236b094c899c22c12ac5097935eb6719293de8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2887a98c03d97a6fcb6c2dab92956f2f4c402cdd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4f654c9bc954569ff9b8ab860b29480c4cf6f57b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62ae24639d22909a5724627a0467e4bde9704020","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d192fc0d6faff25ecf6d52cbde4b939cb12c192","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97582","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:09.010","lastModified":"2026-10-19T10:17:27.540","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (gpio-fan) Fix use-after-free in alarm work\n\nfan_alarm_irq_handler() queues fan_data->alarm_work, but nothing\ncancels it.  fan_alarm_notify() dereferences fan_data and its hwmon\ndevice.  On unbind, devres frees the interrupt, which only waits for\nthe handler itself, and then releases the hwmon device and fan_data,\nso a pending fan_alarm_notify() can run after those frees.\n\nReplace INIT_WORK() with devm_work_autocancel(), registered before\ndevm_request_irq().  The devres cleanup then frees the interrupt\nfirst, so no new work can be queued, and cancels the work while\nfan_data and the hwmon device are still alive.\n\nThis issue was found by an in-house static analysis tool."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/gpio-fan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d6fe1360f42e86262153927986dea6502daff703","lessThan":"594c62eea7c82f526054496e9fa9b895122a8016","versionType":"git","status":"affected"},{"version":"d6fe1360f42e86262153927986dea6502daff703","lessThan":"6e67d9bdac810edacef78cbaeedd34445aa8ceb7","versionType":"git","status":"affected"},{"version":"d6fe1360f42e86262153927986dea6502daff703","lessThan":"e9fc7d53b2eb34c0a607d1659f49b46911aaf16c","versionType":"git","status":"affected"},{"version":"d6fe1360f42e86262153927986dea6502daff703","lessThan":"9b12bd724db9db318e3a68be17693583dc29a066","versionType":"git","status":"affected"},{"version":"d6fe1360f42e86262153927986dea6502daff703","lessThan":"30755d3a5782cd704c8921cac8ee66dffe4383ea","versionType":"git","status":"affected"},{"version":"d6fe1360f42e86262153927986dea6502daff703","lessThan":"c6ab7f855891877a16d2e2ddf0cd0305fd098a85","versionType":"git","status":"affected"},{"version":"d6fe1360f42e86262153927986dea6502daff703","lessThan":"a2471ed17b0e6ff7bfb6b2ea8e6e5b04c309d293","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/gpio-fan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.37","status":"affected"},{"version":"0","lessThan":"2.6.37","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/30755d3a5782cd704c8921cac8ee66dffe4383ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/594c62eea7c82f526054496e9fa9b895122a8016","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e67d9bdac810edacef78cbaeedd34445aa8ceb7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b12bd724db9db318e3a68be17693583dc29a066","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a2471ed17b0e6ff7bfb6b2ea8e6e5b04c309d293","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c6ab7f855891877a16d2e2ddf0cd0305fd098a85","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9fc7d53b2eb34c0a607d1659f49b46911aaf16c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97583","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:09.127","lastModified":"2026-10-19T10:17:27.647","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Clear stale peer app data after address list changes\n\nafs_fs_probe_fileserver() fetches the current endpoint state under\nserver->fs_lock, but leaves old_alist as NULL.  Consequently,\nafs_set_peer_appdata() treats every address list replacement as initial\nsetup and only binds the new peers; it never unbinds peers removed from\nthe old list.\n\nAn address refresh can therefore proceed as follows.  CPU 0 replaces\nserver S's list and drops Pold without clearing Pold->app_data.  The\nserver destroyer then clears only S's current peers and lets S reach its\nRCU callback.  After the callback frees S, CPU 1 handles a callback\nthrough an RxRPC connection that still pins Pold, reads Pold->app_data,\nand calls afs_use_server() on the freed object.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in afs_find_server+0x3c/0xa0\n  Read of size 4 at addr ffff8881013e1af0 by task krxrpcio/7001/74\n  Call Trace:\n   afs_find_server+0x3c/0xa0\n   afs_rx_new_call+0x15c/0x390\n   rxrpc_new_incoming_call+0x97c/0x1730\n   rxrpc_input_packet.constprop.0+0xd03/0xec0\n   rxrpc_io_thread+0x967/0x1640\n  Allocated by task 93:\n   afs_lookup_server+0x1a7/0x14c0\n   afs_alloc_server_list+0x43f/0xb60\n   afs_create_volume+0x923/0x1490\n   afs_get_tree+0x1c6/0x10a0\n  Freed by task 0:\n   kfree+0x131/0x3c0\n   rcu_core+0x50a/0x1850\n  Last potentially related work creation:\n   __call_rcu_common.constprop.0+0x71/0xa10\n   afs_put_server+0x213/0x2b0\n\nPreserve old->addresses for the peer app-data update so that removed\npeers are cleared before the endpoint state is replaced.  Also advance\nboth cursors when the old and new lists share a peer; activating the\nold/new comparison without this would otherwise loop forever on the\nshared entry."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/afs/addr_list.c","fs/afs/fs_probe.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"39ba6af83a7f9dee3e6a7916f41a48bcbda54eba","lessThan":"3afb988fd0411707bdafb9b321086fff0da28aae","versionType":"git","status":"affected"},{"version":"40e8b52fe8c8ab6920ea5f59c5469b6918cce624","lessThan":"c7f77a11a1e719192c7262aad38a3919aec62c21","versionType":"git","status":"affected"},{"version":"40e8b52fe8c8ab6920ea5f59c5469b6918cce624","lessThan":"7f7f5589d048821dea316cbac9b37d27eaf7530e","versionType":"git","status":"affected"},{"version":"40e8b52fe8c8ab6920ea5f59c5469b6918cce624","lessThan":"ba0623fc19a424f4745394c499f9f28a8d88d397","versionType":"git","status":"affected"},{"version":"6.12.101","lessThan":"6.12.111","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/afs/addr_list.c","fs/afs/fs_probe.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3afb988fd0411707bdafb9b321086fff0da28aae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f7f5589d048821dea316cbac9b37d27eaf7530e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba0623fc19a424f4745394c499f9f28a8d88d397","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c7f77a11a1e719192c7262aad38a3919aec62c21","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97584","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:09.267","lastModified":"2026-10-19T10:17:27.777","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix incorrect free in candidate cleanup in afs_lookup_server()\n\nFix afs_lookup_server() to not free an existing server's endpoint state\nwhen cleaning up a candidate server.  The candidate record doesn't have an\nendpoint state yet at this point, so the free for that can just be removed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/afs/server.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d6aa05cd995830f6dcee7b139335edb266de38a6","lessThan":"981d72663dee2fa6efaf202293e68d2b10a0d1d4","versionType":"git","status":"affected"},{"version":"4882ba78574e2d8c579658f65f6784b0d139d173","lessThan":"e5bc0fa9959dc8f7eb1afab7c039594a16a1a65c","versionType":"git","status":"affected"},{"version":"4882ba78574e2d8c579658f65f6784b0d139d173","lessThan":"349e713039a1fd6659c27e7a66238bfa49ce37e9","versionType":"git","status":"affected"},{"version":"4882ba78574e2d8c579658f65f6784b0d139d173","lessThan":"044d596094af4b769fb8e1173dff0d08bd68db6c","versionType":"git","status":"affected"},{"version":"6.12.101","lessThan":"6.12.111","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/afs/server.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/044d596094af4b769fb8e1173dff0d08bd68db6c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/349e713039a1fd6659c27e7a66238bfa49ce37e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/981d72663dee2fa6efaf202293e68d2b10a0d1d4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e5bc0fa9959dc8f7eb1afab7c039594a16a1a65c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97585","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:09.657","lastModified":"2026-10-19T10:17:27.910","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix double-unmap of directory block\n\nFix afs_edit_dir_remove() to use a cleanup function to unmap the block\npointed to by afs_dir_iter::block if it's left pointing to something rather\nthan manually kunmapping the blocks.  Manually kunmapping without clearing\niter.blocks can result in a double-kunmap if afs_dir_find_block() is called\ntwice in a row (which would be the case if the block being modified is not\nfirst in the hash chain)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/afs/dir_edit.c","fs/afs/dir_search.c","fs/afs/internal.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a5b5beebcf96d5e8a2fc79856c2ac1e93f82478e","lessThan":"9d6c703e24da3d39067e3c75f4ac2f6001c2472f","versionType":"git","status":"affected"},{"version":"a5b5beebcf96d5e8a2fc79856c2ac1e93f82478e","lessThan":"b60f51e4ad0f6f940899788ccc2762db1e3b69e6","versionType":"git","status":"affected"},{"version":"a5b5beebcf96d5e8a2fc79856c2ac1e93f82478e","lessThan":"e3cfd3eb7d5be7787cc69530b423f788f14d084f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/afs/dir_edit.c","fs/afs/dir_search.c","fs/afs/internal.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/9d6c703e24da3d39067e3c75f4ac2f6001c2472f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b60f51e4ad0f6f940899788ccc2762db1e3b69e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3cfd3eb7d5be7787cc69530b423f788f14d084f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97586","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:09.770","lastModified":"2026-10-19T10:17:28.023","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix missing kunmap in afs_dir_search_bucket()\n\nFix afs_dir_search_bucket() to kunmap the block it's using in the \"bad:\"\npath."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/afs/dir_search.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a5b5beebcf96d5e8a2fc79856c2ac1e93f82478e","lessThan":"c5fa4eb9c4b2c744ba88fb4ff2d729a158e66832","versionType":"git","status":"affected"},{"version":"a5b5beebcf96d5e8a2fc79856c2ac1e93f82478e","lessThan":"f57d4728ac54921b871868c5d5bd29b8ab50ee12","versionType":"git","status":"affected"},{"version":"a5b5beebcf96d5e8a2fc79856c2ac1e93f82478e","lessThan":"950ae84b5cc944fbe27d81806d0b76af765f779c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/afs/dir_search.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/950ae84b5cc944fbe27d81806d0b76af765f779c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c5fa4eb9c4b2c744ba88fb4ff2d729a158e66832","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f57d4728ac54921b871868c5d5bd29b8ab50ee12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97587","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:09.880","lastModified":"2026-10-21T13:21:14.170","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: RISC-V: store available counter mask as bitmap\n\nThe available-counter mask was a single unsigned long, but iteration\nuses RISCV_MAX_COUNTERS, which is 64. On RV32 that reads past the object.\nFilling with an unsigned-long bit at index 32 and above is also wrong.\n\nUse DECLARE_BITMAP and set_bit/bitmap helpers. Walk each bitmap word\ninto CFG_MATCH when checking events, when allocating an index, and when\nstopping all counters. Set the counter base to i times BITS_PER_LONG.\nShare the CFG_MATCH ecall through a small helper so the 32-bit argument\nsplit is not duplicated. On qemu-system-riscv32 the probe bitmap has bits\nabove XLEN set, so the first word alone is not enough.\n\n[pjw@kernel.org: updated to apply; fixed checkpatch.pl issues]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/perf/riscv_pmu_legacy.c","drivers/perf/riscv_pmu_sbi.c","include/linux/perf/riscv_pmu.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e9991434596f5373dfd75857b445eb92a9253c56","lessThan":"5a1b6379eed5b13eac0228b605b0bed988e547e9","versionType":"git","status":"affected"},{"version":"e9991434596f5373dfd75857b445eb92a9253c56","lessThan":"143668c424772979a45118dc9cc9c2c13a35f41d","versionType":"git","status":"affected"},{"version":"e9991434596f5373dfd75857b445eb92a9253c56","lessThan":"9bec7beaed074bcae4181fde9ff9dfbe4e7b0957","versionType":"git","status":"affected"},{"version":"e9991434596f5373dfd75857b445eb92a9253c56","lessThan":"e5481db31f4654e9a1254d5d467d9b1ff2f8b1cb","versionType":"git","status":"affected"},{"version":"e9991434596f5373dfd75857b445eb92a9253c56","lessThan":"6809da6e9c08ccc9a09cb0a48c61471679274aaa","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/perf/riscv_pmu_legacy.c","drivers/perf/riscv_pmu_sbi.c","include/linux/perf/riscv_pmu.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/143668c424772979a45118dc9cc9c2c13a35f41d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5a1b6379eed5b13eac0228b605b0bed988e547e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6809da6e9c08ccc9a09cb0a48c61471679274aaa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9bec7beaed074bcae4181fde9ff9dfbe4e7b0957","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e5481db31f4654e9a1254d5d467d9b1ff2f8b1cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97588","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:09.990","lastModified":"2026-10-19T10:17:28.253","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/crypto: Map EBUSY to EIO when key conversion fails repeatedly\n\nWhen hardware persistently returns -EBUSY after exhausting retries,\nthe error propagates to crypto_finalize_*_request(). The crypto API's\ncompletion wrapper treats -EBUSY as a queueing status and swallows it,\npreventing the completion callback from firing. This causes callers\nusing crypto_wait_req() to block indefinitely.\n\nTranslate persistent -EBUSY to -EIO after retry exhaustion to ensure\nproper error propagation and callback invocation."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/s390/crypto/paes_s390.c","arch/s390/crypto/phmac_s390.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6cd87cb5ef6ca50ae17c371482ceaab1d635e232","lessThan":"f6b263679aa72ad2e534bf93db55f2589549a40e","versionType":"git","status":"affected"},{"version":"6cd87cb5ef6ca50ae17c371482ceaab1d635e232","lessThan":"e267bd142664a181474112392aeaa8b3d4b12f2e","versionType":"git","status":"affected"},{"version":"6cd87cb5ef6ca50ae17c371482ceaab1d635e232","lessThan":"7a08507ea5b4d06ad8d269287913573f34467565","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/s390/crypto/paes_s390.c","arch/s390/crypto/phmac_s390.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/7a08507ea5b4d06ad8d269287913573f34467565","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e267bd142664a181474112392aeaa8b3d4b12f2e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f6b263679aa72ad2e534bf93db55f2589549a40e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97589","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:10.103","lastModified":"2026-10-19T10:17:28.363","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/crypto: Fix wrong return code to engine in asynch callbacks\n\nWhen crypto_finalize_hash_request() or\ncrypto_finalize_skcipher_request() explicitly completes a request, the\ndo_one_request callback must return 0 to indicate successful\nhandling. Returning a negative error code causes the crypto engine to\nassume the driver failed to take ownership and triggers a second\ncompletion via crypto_request_complete(), resulting in a double\ncompletion. This pattern occurs in paes_s390.c 4 times and once in\nphmac_s390.c.\n\nFixed in phmac_do_one_request() and all four paes do_one_request\ncallbacks (ecb, cbc, ctr, xts) by returning 0 after explicit\nfinalization instead of propagating the error code."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/s390/crypto/paes_s390.c","arch/s390/crypto/phmac_s390.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6cd87cb5ef6ca50ae17c371482ceaab1d635e232","lessThan":"972e0d9b7d1d112240ccde1f1be85bf9ffaa1720","versionType":"git","status":"affected"},{"version":"6cd87cb5ef6ca50ae17c371482ceaab1d635e232","lessThan":"5480291aa848e19e61175abfd457933516db70c6","versionType":"git","status":"affected"},{"version":"6cd87cb5ef6ca50ae17c371482ceaab1d635e232","lessThan":"ac1481320110b803ab9b79ab4d2ca11a74fc05f2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/s390/crypto/paes_s390.c","arch/s390/crypto/phmac_s390.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/5480291aa848e19e61175abfd457933516db70c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/972e0d9b7d1d112240ccde1f1be85bf9ffaa1720","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac1481320110b803ab9b79ab4d2ca11a74fc05f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97590","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:10.207","lastModified":"2026-10-19T10:17:28.483","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/crypto: Fix missing scrub of temp buffers with PAES algorithm\n\nIn function ctr_paes_do_crypt() there is a buffer used to process\nremaining bytes < AES_BLOCK_SIZE. This buffer was not scrubbed and\nthus could lead to expose of unwanted data. Rework the code to\nexplicitly scrub the buffer at the end of the function to avoid\nexposure of maybe sensitive data.\n\nIn function __xts_2keys_prep_param() change the existing scrub to\nclean the whole param block instead of just the key field."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/s390/crypto/paes_s390.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6cd87cb5ef6ca50ae17c371482ceaab1d635e232","lessThan":"7d1456d54b3c784cc2917c219a528092cefe30cd","versionType":"git","status":"affected"},{"version":"6cd87cb5ef6ca50ae17c371482ceaab1d635e232","lessThan":"d7159d2132e9aa51af7acb51c6742d9b30f987b3","versionType":"git","status":"affected"},{"version":"6cd87cb5ef6ca50ae17c371482ceaab1d635e232","lessThan":"19a218b46b2471d370c11fb52040f36ac8d05d23","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/s390/crypto/paes_s390.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/19a218b46b2471d370c11fb52040f36ac8d05d23","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d1456d54b3c784cc2917c219a528092cefe30cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7159d2132e9aa51af7acb51c6742d9b30f987b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97591","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:10.313","lastModified":"2026-10-19T10:17:28.590","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine\n\nWhen a request is transferred to the engine via\ncrypto_transfer_hash_request_to_engine() there are two return codes\nsignaling a successful transfer: EINPROGRESS and EBUSY. However the\ncorrect handling of EBUSY was missing and has been added as a return\ncode indicating a successful transfer to the crypto engine."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/s390/crypto/phmac_s390.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cbbc675506cc4cd93e6f895e7c1f693156f9a95c","lessThan":"203702f0013f9b7324e8c5facb6cd6e9c0942b13","versionType":"git","status":"affected"},{"version":"cbbc675506cc4cd93e6f895e7c1f693156f9a95c","lessThan":"bcd7f1f1e2f2882ad206f72425255be105178151","versionType":"git","status":"affected"},{"version":"cbbc675506cc4cd93e6f895e7c1f693156f9a95c","lessThan":"330148371401de474b656eaf521861f12ec1a1ce","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/s390/crypto/phmac_s390.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/203702f0013f9b7324e8c5facb6cd6e9c0942b13","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/330148371401de474b656eaf521861f12ec1a1ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bcd7f1f1e2f2882ad206f72425255be105178151","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97592","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:10.423","lastModified":"2026-10-19T10:17:28.697","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm\n\nIn function ctr_aes_crypt() there is a buffer used to process\nremaining bytes < AES_BLOCK_SIZE. This buffer was not scrubbed and\nthus could lead to expose of unwanted data. When the buffer is used\nexplicitly scrub it at the end of the code block to avoid exposure of\nmaybe sensitive data.\n\nIn a similar way the function gcm_aes_crypt() hat an error path where\nthe CPACF param block was not scrubbed. Instead of return early now\nthese error paths go to end of function where explicit scrubbing is\ndone. Similar with the buffers which are part of the gcm_sg_walk\nstructs from the variables gw_in and gw_out."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/s390/crypto/aes_s390.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cd51e26a3b89706beec64f2d8296cfb1c34e0c79","lessThan":"538f00558db9a66aeff20c36f43692c178a0e0eb","versionType":"git","status":"affected"},{"version":"a7f580cdb42ec3d53bbb7c4e4335a98423703285","lessThan":"6ab772d675a885c3119bf0e79ea9e84756d7657a","versionType":"git","status":"affected"},{"version":"dbc9a791a70ea47be9f2acf251700fe254a2ab23","lessThan":"e17b85eb8cee90a1200fa5e7806db7ffa08a0608","versionType":"git","status":"affected"},{"version":"d68ac38895e84446848b7647ab9458d54cacba3e","lessThan":"991c875310254a13b3a637bb279379c8c66e842d","versionType":"git","status":"affected"},{"version":"d07f951903fa9922c375b8ab1ce81b18a0034e3b","lessThan":"11eca05d2062032e1f07d56be58ed0b99f4b1d63","versionType":"git","status":"affected"},{"version":"d07f951903fa9922c375b8ab1ce81b18a0034e3b","lessThan":"8b90a47c4fba27bb4f2f086611742493629e9696","versionType":"git","status":"affected"},{"version":"d07f951903fa9922c375b8ab1ce81b18a0034e3b","lessThan":"a83488cecb35f924b7541306ed84893bb9906196","versionType":"git","status":"affected"},{"version":"d07f951903fa9922c375b8ab1ce81b18a0034e3b","lessThan":"8b7c3b6914f19caf648d05726a86af6326d3c2c6","versionType":"git","status":"affected"},{"version":"e78f1a43e72daf77705ad5b9946de66fc708b874","versionType":"git","status":"affected"},{"version":"5.10.210","lessThan":"5.10.271","versionType":"semver","status":"affected"},{"version":"5.15.149","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"6.1.76","lessThan":"6.1.189","versionType":"semver","status":"affected"},{"version":"6.6.15","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.7.3","lessThan":"6.8","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/s390/crypto/aes_s390.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/11eca05d2062032e1f07d56be58ed0b99f4b1d63","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/538f00558db9a66aeff20c36f43692c178a0e0eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ab772d675a885c3119bf0e79ea9e84756d7657a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b7c3b6914f19caf648d05726a86af6326d3c2c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b90a47c4fba27bb4f2f086611742493629e9696","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/991c875310254a13b3a637bb279379c8c66e842d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a83488cecb35f924b7541306ed84893bb9906196","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e17b85eb8cee90a1200fa5e7806db7ffa08a0608","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97593","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:10.547","lastModified":"2026-10-19T10:17:28.823","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX\n\nWhen using a 5-level translation table via ZPCI_TABLE_TYPE_RFX\nget_rso_from_iova() returns NULL when the region-first entry is invalid.\nYet in get_rto_from_iova() the region-second origin rso is not checked\nto be non-NULL before accessing rso[rsx] leading to a NULL pointer\ndereference instead of a NULL return when iova_to_phys() is called on\na unmapped IOVA. Fix this by adding the missing NULL check."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/iommu/s390-iommu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"81244074b518aeb90de5f68e7e825564c29c5c50","lessThan":"d0502ed0a1aae97e2ab7a21545903ba612d9f02e","versionType":"git","status":"affected"},{"version":"81244074b518aeb90de5f68e7e825564c29c5c50","lessThan":"41b5e0ce6801bf04d8fd3bca46e8c393349ebd5c","versionType":"git","status":"affected"},{"version":"81244074b518aeb90de5f68e7e825564c29c5c50","lessThan":"20db6573301e66cd65ebf6c130b6563c69374d9d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/iommu/s390-iommu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/20db6573301e66cd65ebf6c130b6563c69374d9d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41b5e0ce6801bf04d8fd3bca46e8c393349ebd5c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0502ed0a1aae97e2ab7a21545903ba612d9f02e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97594","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:10.653","lastModified":"2026-10-21T13:21:14.293","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Fix use-after-free of the source's parent directory\n\ncurrent_check_refer_path() reads old_dentry->d_parent without holding a\nreference nor a lock on it, and then dereferences it in\ncollect_domain_accesses() and in the audit record.\n\nA reference on a child does not pin its parent: __d_move() reassigns\ndentry->d_parent and drops the reference the child held on its former\nparent.  hook_path_rename() is not affected because the rename path\ncalls lock_rename() before the hook, so the source cannot be reparented\nunder it.  hook_path_link() has no such protection: filename_linkat()\nholds a reference on the source dentry but neither locks nor references\nits parent, so a concurrent rename(2) can reparent the source while\nsecurity_path_link() runs, and the former parent can then be removed and\nfreed while the hook walks it.\n\nA process can trigger this after entering a Landlock domain that handles\nat least one filesystem access right.  The process can then race a\nlinkat(2) loop against rename(2) and rmdir(2):\n\n  BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278/0x290\n  Read of size 4 at addr ffff888160bd53f4 by task llrepro2/549\n   collect_domain_accesses+0x278/0x290\n   current_check_refer_path+0x952/0x1120\n   security_path_link+0x1be/0x320\n   filename_linkat+0x342/0x6d0\n   __x64_sys_linkat+0xfa/0x150\n  Freed by task 562:\n   kmem_cache_free+0x139/0x4c0\n   i_callback+0x4b/0x80\n   rcu_core+0x7dc/0x10a0\n\nTake a reference on the dentry selected as the source parent, using\ndget() for the common-mount-root case and dget_parent() otherwise.\nRelease it after the hierarchy walk and synchronous audit logging.\n\n[mic: Clarify the caller, reachability, and reference handling]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/landlock/fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b91c3e4ea756b12b7d992529226edce1cfd854d7","lessThan":"48fc1c74052c956c59d5b16b5e18e0dd36b76aa2","versionType":"git","status":"affected"},{"version":"b91c3e4ea756b12b7d992529226edce1cfd854d7","lessThan":"4c37992b9668c4f37aae41dd95c369f7b6009915","versionType":"git","status":"affected"},{"version":"b91c3e4ea756b12b7d992529226edce1cfd854d7","lessThan":"379efd2ce8b26fd35feb13ccc2f671ff105a5052","versionType":"git","status":"affected"},{"version":"b91c3e4ea756b12b7d992529226edce1cfd854d7","lessThan":"ba29c46ccfe3ebadfb8aa18149186c49f84b14f8","versionType":"git","status":"affected"},{"version":"b91c3e4ea756b12b7d992529226edce1cfd854d7","lessThan":"2c6dc792538260a8087ac5b22c31b3b8e47c85d6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/landlock/fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2c6dc792538260a8087ac5b22c31b3b8e47c85d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/379efd2ce8b26fd35feb13ccc2f671ff105a5052","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/48fc1c74052c956c59d5b16b5e18e0dd36b76aa2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c37992b9668c4f37aae41dd95c369f7b6009915","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba29c46ccfe3ebadfb8aa18149186c49f84b14f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97595","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:10.770","lastModified":"2026-10-19T10:17:29.053","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix use-after-free of sdata via queued RX frames\n\nThe RX softirq producer ieee802154_subif_frame() queues received beacon\nand MAC-command frames onto local->rx_beacon_list / rx_mac_cmd_list and\nschedules a process-context worker, storing a raw mac_pkt->sdata (and\nskb->dev == sdata->dev) with neither a reference nor any locking:\n\n - the lists have no lock: the softirq producer list_add_tail()s while the\n   mac_wq worker list_del()s, so sibling interfaces on the same phy corrupt\n   the list;\n\n - the workers dereference the interface after it may have been freed.\n   mac802154_rx_mac_cmd_worker() touches mac_pkt->sdata directly, and\n   mac802154_rx_beacon_worker() -> mac802154_process_beacon() dereferences\n   skb->dev (== sdata->dev). Removing an interface frees its sdata\n   (netdev_priv) while a queued frame still points at it, so a later worker\n   run is a use-after-free.\n\nReproduced under KASAN by flooding a victim interface with MAC command\nframes and removing it (the beacon path is the same class via skb->dev):\n\n  BUG: KASAN: slab-use-after-free in mac802154_rx_mac_cmd_worker+0x463/0x630 [mac802154]\n  Read of size 4 at addr ffff888002f9ea18 by task kworker/u8:1/31\n  Workqueue: phy0-mac-cmds mac802154_rx_mac_cmd_worker [mac802154]\n  Call Trace:\n   mac802154_rx_mac_cmd_worker+0x463/0x630 [mac802154]\n   process_one_work+0x611/0xe80\n   worker_thread+0x52e/0xdc0\n   kthread+0x30c/0x630\n   ret_from_fork+0x2fd/0x3e0\n\nFix both lists together:\n\n - add local->rx_lock and take it around every list access: the softirq\n   producer (plain spin_lock, softirq context) and the workers and flush\n   (spin_lock_bh, process context);\n\n - pin the interface for the lifetime of a queued frame with\n   netdev_hold()/netdev_put(), so the worker can safely dereference sdata /\n   skb->dev even while the interface is being removed;\n\n - dequeue under the lock at the head and loop-drain the whole list in the\n   workers (they previously processed one frame per run and relied on a\n   later enqueue to drain the rest);\n\n - drop not-yet-started frames of an interface before it is unregistered,\n   from ieee802154_if_remove() (after the RCU grace period) and from the\n   ieee802154_remove_interfaces() loop -- the latter is the whole-phy\n   teardown path, which does not go through ieee802154_if_remove().\n\nAn in-flight worker that already dequeued a frame keeps its own netdev\nreference; unregister_netdevice() then waits it out in netdev_run_todo(),\nwhich runs at rtnl_unlock() (rtnl released) and after the interface has\nbeen closed, so it does not pin rtnl. A worker blocked in an association\nTX only delays that one interface's unregister (the usual \"waiting for %s\nto become free\"), it does not hold rtnl. netdev_hold() is used for this\nreason instead of a cancel_work_sync() under rtnl, which would block on\nthe worker's unbounded MLME TX wait via ieee802154_sync_queue().\n\nThe mac-command worker additionally skips processing for a stopped\ninterface (ieee802154_sdata_running()), avoiding a needless association\nresponse during teardown."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/cfg802154.h","net/mac802154/ieee802154_i.h","net/mac802154/iface.c","net/mac802154/main.c","net/mac802154/rx.c","net/mac802154/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"57588c71177f0bfc08509c2c3a9bfe32850c0786","lessThan":"4826fd8373f684f9952536333ad45b26acd3455d","versionType":"git","status":"affected"},{"version":"57588c71177f0bfc08509c2c3a9bfe32850c0786","lessThan":"4740ef0518c5e3bf31ebfb2288a6ac3b462ead06","versionType":"git","status":"affected"},{"version":"57588c71177f0bfc08509c2c3a9bfe32850c0786","lessThan":"07f0214018d7241e3610c1be984c8abfce16c099","versionType":"git","status":"affected"},{"version":"57588c71177f0bfc08509c2c3a9bfe32850c0786","lessThan":"3d1fde35f95d7f02a7dc473c51d81e8d9e992cfc","versionType":"git","status":"affected"},{"version":"57588c71177f0bfc08509c2c3a9bfe32850c0786","lessThan":"2f37fba846c9fdff5fc15b6d93656057ccd13031","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/cfg802154.h","net/mac802154/ieee802154_i.h","net/mac802154/iface.c","net/mac802154/main.c","net/mac802154/rx.c","net/mac802154/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/07f0214018d7241e3610c1be984c8abfce16c099","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2f37fba846c9fdff5fc15b6d93656057ccd13031","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3d1fde35f95d7f02a7dc473c51d81e8d9e992cfc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4740ef0518c5e3bf31ebfb2288a6ac3b462ead06","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4826fd8373f684f9952536333ad45b26acd3455d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97596","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:10.907","lastModified":"2026-10-19T10:17:29.200","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: reject invalid states in connection template sync records\n\nIPVS sync receivers validate protocol states before creating or updating a\nconnection. For connection templates, however, they only log states outside\nthe template state range and still store the value in the connection.\n\nA template can be returned by ordinary connection lookup. TCP and SCTP then\nuse the invalid state as an index into their transition tables.\n\nReject invalid template states in both sync protocol versions before\nlooking up or modifying a connection. The version 1 path handles both\nIPv4 and IPv6 records."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/ipvs/ip_vs_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"275411430f892407b885be1de2548b2e632892c3","lessThan":"5677e81ffdbfc1c03dcb427fb8b1c38289bed76d","versionType":"git","status":"affected"},{"version":"275411430f892407b885be1de2548b2e632892c3","lessThan":"d4eb339b442a0ffaa565779b975494a0a0664f18","versionType":"git","status":"affected"},{"version":"275411430f892407b885be1de2548b2e632892c3","lessThan":"1a8f15911352bb3cf4663aa02049c49c7f30e524","versionType":"git","status":"affected"},{"version":"275411430f892407b885be1de2548b2e632892c3","lessThan":"652d9caa5ac925ab012834e325d77b9ed638d4fc","versionType":"git","status":"affected"},{"version":"275411430f892407b885be1de2548b2e632892c3","lessThan":"fc10dc4511e6e2e2b4098ee115c8e5639471f23d","versionType":"git","status":"affected"},{"version":"275411430f892407b885be1de2548b2e632892c3","lessThan":"50c3f06222eafe9cca7ca51a0ef83311d7cab353","versionType":"git","status":"affected"},{"version":"275411430f892407b885be1de2548b2e632892c3","lessThan":"0c61f7d8e18a978aec2a16d9acd5f682f1c72476","versionType":"git","status":"affected"},{"version":"275411430f892407b885be1de2548b2e632892c3","lessThan":"74cb39735b6cd0aff4b5584158f09376fd97aadf","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/ipvs/ip_vs_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0c61f7d8e18a978aec2a16d9acd5f682f1c72476","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1a8f15911352bb3cf4663aa02049c49c7f30e524","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/50c3f06222eafe9cca7ca51a0ef83311d7cab353","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5677e81ffdbfc1c03dcb427fb8b1c38289bed76d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/652d9caa5ac925ab012834e325d77b9ed638d4fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74cb39735b6cd0aff4b5584158f09376fd97aadf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d4eb339b442a0ffaa565779b975494a0a0664f18","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc10dc4511e6e2e2b4098ee115c8e5639471f23d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97597","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:11.017","lastModified":"2026-10-21T13:21:14.457","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: flowlabel: cap duplicate leases per socket\n\nipv6_flowlabel_get() allocates an ipv6_fl_socklist entry for every\nsuccessful GET. The recheck path for a compatible existing flowlabel\nlinks another lease without applying any lease admission check. Repeated\nGET requests for one shareable label can therefore grow a socket's lease\nlist without bound.\n\nReject a new unprivileged lease once the socket already holds\nFL_MAX_PER_SOCK leases. Check this on the shared recheck path so reuse\nof a globally interned label, including the fl_intern() collision path,\nis covered as well. New-label admission remains under the existing\nmem_check() policy.\n\nUse capable(CAP_NET_ADMIN) rather than ns_capable(), matching\nmem_check(). An unprivileged user must not bypass the cap by creating a\nuser namespace and a netns where they have CAP_NET_ADMIN, which would\nstill consume host memory.\n\nCheck the capability only when the socket reaches the limit, so\nsuccessful unprivileged GET requests below the cap do not generate a\ncapability audit. Do the admission check before updating linger and\nexpires so a rejected GET does not refresh the shared label, matching\nthe existing socket-list allocation failure path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/ip6_flowlabel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"0159f716d8adbe85951cdf008d0afe27d874eaa6","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6d917992c22b6029fc2dc1bd464b7f6709357161","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2f1a6dd5c80ceb902f50449efe899f29cd7918e3","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"467467bf4209f9f8add0c648bae763f92a0224c3","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8d6cd188508513503805c156165de38e4e4a8615","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/ip6_flowlabel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0159f716d8adbe85951cdf008d0afe27d874eaa6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2f1a6dd5c80ceb902f50449efe899f29cd7918e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/467467bf4209f9f8add0c648bae763f92a0224c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d917992c22b6029fc2dc1bd464b7f6709357161","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8d6cd188508513503805c156165de38e4e4a8615","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97598","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:11.130","lastModified":"2026-10-19T10:17:29.457","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: bound automatic table ID allocation\n\nfib_empty_table() probes every table ID from 1 until it finds a\nfree one.  IPv4 tables are stored in a 256-bucket hash table, so a\ndense set of IDs makes each probe walk a growing hash chain while\nRTNL is held.\n\nAutomatic table assignment (\"ip rule ... table 0\") is an IPv4-only\nlegacy path.  Bound the automatically allocated ID to 4096 so the\nRTNL hold stays bounded, without changing lookups of explicitly\nspecified table IDs.\n\nThis changes user-visible behavior.  A table-0 rule previously\nreceived the lowest free ID in 1..RT_TABLE_MAX (0xFFFFFFFF).  After\nthis patch the search stops at 4096 and the rule add fails with\nENOBUFS if that range is fully occupied.  Explicit table IDs above\n4096 remain usable.\n\nThe automatic path is unused in practice: it is IPv4-only, not\ndocumented by ip-rule, uncovered by kernel selftests, and both\nNetworkManager and systemd refuse table 0."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/fib_rules.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b801f54917b7c6e8540f877ee562cd0725e62ebd","lessThan":"999bc00588cb305ab25065e8a8ac31da7465301c","versionType":"git","status":"affected"},{"version":"b801f54917b7c6e8540f877ee562cd0725e62ebd","lessThan":"f1f2da33eaab54b4d5cdea6d70befb2e2fb49cb6","versionType":"git","status":"affected"},{"version":"b801f54917b7c6e8540f877ee562cd0725e62ebd","lessThan":"125890702ef4417cd0ffac2e448c0cd4fbf0ac45","versionType":"git","status":"affected"},{"version":"b801f54917b7c6e8540f877ee562cd0725e62ebd","lessThan":"3080f9e653d8c057d5652db5ced8137f81b3fcbd","versionType":"git","status":"affected"},{"version":"b801f54917b7c6e8540f877ee562cd0725e62ebd","lessThan":"bc8d01d856db106f284b19961af6112e10c3e3b4","versionType":"git","status":"affected"},{"version":"b801f54917b7c6e8540f877ee562cd0725e62ebd","lessThan":"fe9a906d2bff2d2707bafd6353b5e032a42aeb35","versionType":"git","status":"affected"},{"version":"b801f54917b7c6e8540f877ee562cd0725e62ebd","lessThan":"2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503","versionType":"git","status":"affected"},{"version":"b801f54917b7c6e8540f877ee562cd0725e62ebd","lessThan":"efdfb1e27a3328085b79540dfe781d537b576ea1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/fib_rules.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.19","status":"affected"},{"version":"0","lessThan":"2.6.19","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/125890702ef4417cd0ffac2e448c0cd4fbf0ac45","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3080f9e653d8c057d5652db5ced8137f81b3fcbd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/999bc00588cb305ab25065e8a8ac31da7465301c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc8d01d856db106f284b19961af6112e10c3e3b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/efdfb1e27a3328085b79540dfe781d537b576ea1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1f2da33eaab54b4d5cdea6d70befb2e2fb49cb6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe9a906d2bff2d2707bafd6353b5e032a42aeb35","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97599","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:11.243","lastModified":"2026-10-19T10:17:29.587","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nieee802154: hwsim: serialize pib updates to fix double-free\n\nhwsim_update_pib() does an unserialized read-swap-free of phy->pib:\n\n\tpib_old = rtnl_dereference(phy->pib);\n\t...\n\trcu_assign_pointer(phy->pib, pib);\n\tkfree_rcu(pib_old, rcu);\n\nIt assumes the RTNL is held, but ->set_channel is not always called\nunder it: the mac802154 scan worker changes channels via\ndrv_set_channel() without the RTNL. Such an update can race an\nRTNL-held one on the same phy; both read the same pib_old and both\nkfree_rcu() it, double-freeing the object. With SLUB percpu sheaves\nbatching kfree_rcu(), this surfaces as a KASAN invalid-free in\nrcu_free_sheaf().\n\nstruct hwsim_phy has no lock for pib. Add one and make the swap atomic\nwith rcu_replace_pointer() under it, dropping the misleading\nrtnl_dereference()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ieee802154/mac802154_hwsim.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f25da51fdc381ca2863248c7060b3662632f0872","lessThan":"e3b4681197aa026bd2d79358de5a3d62b76b04b9","versionType":"git","status":"affected"},{"version":"f25da51fdc381ca2863248c7060b3662632f0872","lessThan":"9973b3a67a7592a780ea12b08334539a900deec1","versionType":"git","status":"affected"},{"version":"f25da51fdc381ca2863248c7060b3662632f0872","lessThan":"d3b8f264ce09573aededd0a97dc41c8147797d8f","versionType":"git","status":"affected"},{"version":"f25da51fdc381ca2863248c7060b3662632f0872","lessThan":"db6442deecb1f13aeaf4f9d77746ea7555630fb3","versionType":"git","status":"affected"},{"version":"f25da51fdc381ca2863248c7060b3662632f0872","lessThan":"979d5b8de8ed4e1f997aef12da5694b99be7b871","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ieee802154/mac802154_hwsim.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/979d5b8de8ed4e1f997aef12da5694b99be7b871","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9973b3a67a7592a780ea12b08334539a900deec1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3b8f264ce09573aededd0a97dc41c8147797d8f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db6442deecb1f13aeaf4f9d77746ea7555630fb3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3b4681197aa026bd2d79358de5a3d62b76b04b9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97600","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:11.353","lastModified":"2026-10-21T13:21:14.597","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nieee802154: cc2520: fix FIFOP work use-after-free\n\nThe FIFOP interrupt handler queues cc2520_fifop_irqwork.  On removal,\ncc2520_remove() only flushes the work.  The devm-managed FIFOP IRQ\nremains active until after ->remove() returns and can queue the work\nagain after that flush, allowing it to run after the private data is\nreleased.\n\nDisable the work with disable_work_sync() instead of flushing it, so\nthe handler can no longer queue it once removal begins.  Destroy the\nbuffer mutex last, since the worker and the stop callback invoked\nthrough ieee802154_unregister_hw() both take it.\n\nFound by an in-house static analysis tool."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ieee802154/cc2520.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0da6bc8cc3417a5e452efb886ff2c61e72b743d6","lessThan":"4a1ba62a486a4c43af91d01661a95e82dc4aaefa","versionType":"git","status":"affected"},{"version":"0da6bc8cc3417a5e452efb886ff2c61e72b743d6","lessThan":"56a9919d8494fb118eebf167bef0622528fbf2e7","versionType":"git","status":"affected"},{"version":"0da6bc8cc3417a5e452efb886ff2c61e72b743d6","lessThan":"c68fd52c73b676aee67020011e98fea125a978f4","versionType":"git","status":"affected"},{"version":"0da6bc8cc3417a5e452efb886ff2c61e72b743d6","lessThan":"890a80d516a1447db5c21bf92841a82914ea897d","versionType":"git","status":"affected"},{"version":"0da6bc8cc3417a5e452efb886ff2c61e72b743d6","lessThan":"ff5891b266a7fc6a062710836be84f1cc19338b5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ieee802154/cc2520.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.17","status":"affected"},{"version":"0","lessThan":"3.17","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4a1ba62a486a4c43af91d01661a95e82dc4aaefa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/56a9919d8494fb118eebf167bef0622528fbf2e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/890a80d516a1447db5c21bf92841a82914ea897d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c68fd52c73b676aee67020011e98fea125a978f4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff5891b266a7fc6a062710836be84f1cc19338b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97601","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:11.463","lastModified":"2026-10-19T10:17:29.813","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nieee802154: 6lowpan: fix NULL dereference in lowpan_newlink\n\nTUNSETLINK allows a TUN device to change its link-layer type to\nARPHRD_IEEE802154 without initializing ieee802154_ptr. lowpan_newlink()\nchecks only the device type before dereferencing the pointer, so an\nRTM_NEWLINK request can trigger a NULL pointer dereference.\n\nReject devices without ieee802154_ptr along with devices of the wrong type."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ieee802154/6lowpan/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"51e0e5d8124ece158927a4c2288c0929d3b53aa3","lessThan":"a1760f21c32adce41af5ed5687200865d8feaaeb","versionType":"git","status":"affected"},{"version":"51e0e5d8124ece158927a4c2288c0929d3b53aa3","lessThan":"5063b9354e6e285dae61e530b30458498444a914","versionType":"git","status":"affected"},{"version":"51e0e5d8124ece158927a4c2288c0929d3b53aa3","lessThan":"16d8e0b560d50cd1a9e6d77a9a154a94c4d6021e","versionType":"git","status":"affected"},{"version":"51e0e5d8124ece158927a4c2288c0929d3b53aa3","lessThan":"543994fa03c36a91d967a12c5c99cae74899504c","versionType":"git","status":"affected"},{"version":"51e0e5d8124ece158927a4c2288c0929d3b53aa3","lessThan":"1c7710af7ad9532b534f1c134c11b04dbe4e0e0f","versionType":"git","status":"affected"},{"version":"51e0e5d8124ece158927a4c2288c0929d3b53aa3","lessThan":"98ce5a42cde780ee0e40378607d4428c8fc12ec1","versionType":"git","status":"affected"},{"version":"51e0e5d8124ece158927a4c2288c0929d3b53aa3","lessThan":"8528da2333ce05cf627f93425f9d05efb08b3146","versionType":"git","status":"affected"},{"version":"51e0e5d8124ece158927a4c2288c0929d3b53aa3","lessThan":"bf79662bc85e820ac3b846e2f347da29fbf6ac95","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ieee802154/6lowpan/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.3","status":"affected"},{"version":"0","lessThan":"4.3","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/16d8e0b560d50cd1a9e6d77a9a154a94c4d6021e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1c7710af7ad9532b534f1c134c11b04dbe4e0e0f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5063b9354e6e285dae61e530b30458498444a914","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/543994fa03c36a91d967a12c5c99cae74899504c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8528da2333ce05cf627f93425f9d05efb08b3146","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98ce5a42cde780ee0e40378607d4428c8fc12ec1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a1760f21c32adce41af5ed5687200865d8feaaeb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf79662bc85e820ac3b846e2f347da29fbf6ac95","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97602","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:11.573","lastModified":"2026-10-19T10:17:29.963","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: invalidate queues before flushing them\n\nfqdir_pre_exit() flushes the skbs from incomplete queues without\nchanging their completion state. A fragment which found a queue before\nhigh_thresh was cleared can then acquire the queue lock and reuse stale\nreassembly metadata. A queue concurrently killed after fqdir->dead is\nset can instead become INET_FRAG_COMPLETE|INET_FRAG_HASH_DEAD while\nstill holding its old skbs; skipping it because it is complete leaves\nthose references behind until asynchronous fqdir teardown.\n\nFor IPv6, stale metadata can make ip6_frag_reasm() use the old\nnhoffset with a new skb and access memory out of bounds. The resulting\nheap corruption can be leveraged for local privilege escalation when\nunprivileged network namespaces are available. Unflushed fragments can\nalso keep conntrack references alive after the conntrack per-net\ncleanup point.\n\nKill each incomplete queue, then flush every queue still owned by the\ndying rhashtable. HASH_DEAD identifies that ownership, while complete\nqueues without it are already owned by another destroy path and must be\nleft alone. Releasing a timer reference removed by inet_frag_kill() is\ndeferred to inet_frag_putn(), after the queue lock is dropped.\n\nKASAN report:\n\n  BUG: KASAN: slab-out-of-bounds in ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2))\n  Write of size 1 at addr ff110001039c6e00 by task poc/771\n  Call Trace:\n  ? ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2))\n  ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2))\n  ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479 (discriminator 5))\n  ip6_input_finish (net/ipv6/ip6_input.c:534)\n  ipv6_rcv (include/net/dst.h:480 (discriminator 3) net/ipv6/ip6_input.c:119 (discriminator 3) net/ipv6/ip6_input.c:109 (discriminator 3) include/linux/netfilter.h:325 (discriminator 3) include/linux/netfilter.h:319 (discriminator 3) net/ipv6/ip6_input.c:351 (discriminator 3))\n  packet_sendmsg (net/packet/af_packet.c:3110 net/packet/af_packet.c:3142)\n  __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880)\n  The buggy address belongs to the object at ff110001039c6b40\n  which belongs to the cache skbuff_small_head of size 704\n  The buggy address is located 0 bytes to the right of\n  allocated 704-byte region [ff110001039c6b40, ff110001039c6e00)\n\n  BUG: KASAN: slab-out-of-bounds in ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1))\n  Read of size 1 at addr ff110001039c6e08 by task poc/771\n  Call Trace:\n  ? ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1))\n  ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1))\n  ip6_input_finish (net/ipv6/ip6_input.c:534)\n  ipv6_rcv (include/net/dst.h:480 (discriminator 3) net/ipv6/ip6_input.c:119 (discriminator 3) net/ipv6/ip6_input.c:109 (discriminator 3) include/linux/netfilter.h:325 (discriminator 3) include/linux/netfilter.h:319 (discriminator 3) net/ipv6/ip6_input.c:351 (discriminator 3))\n  packet_sendmsg (net/packet/af_packet.c:3110 net/packet/af_packet.c:3142)\n  __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880)\n  packet_sendmsg (net/packet/af_packet.c:2959 net/packet/af_packet.c:3053 net/packet/af_packet.c:3142)\n  __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880)\n  The buggy address belongs to the object at ff110001039c6b40\n  which belongs to the cache skbuff_small_head of size 704\n  The buggy address is located 8 bytes to the right of\n  allocated 704-byte region [ff110001039c6b40, ff110001039c6e00)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/inet_fragment.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"22ee4010866da81aeee08e1ea3fddbe418feb212","lessThan":"ff83367cda8eefbd62007ef1dff4f8104226d18a","versionType":"git","status":"affected"},{"version":"543555954b1ee8d1903a7020324efb41b0c97428","lessThan":"b9d77f1652e79e58eac48430d0431c329137efcc","versionType":"git","status":"affected"},{"version":"c70df25214ac9b32b53e18e6ae3b8f073ffa6903","lessThan":"7cb5f4643a7fcdbfbee1fad3cdfc678add62d378","versionType":"git","status":"affected"},{"version":"006a5035b495dec008805df249f92c22c89c3d2e","lessThan":"bf3d6c44c84c57e8a4bb7f40ad95b64f9b0198ba","versionType":"git","status":"affected"},{"version":"006a5035b495dec008805df249f92c22c89c3d2e","lessThan":"b824476c56a153934c67c9e0f873e1fd967743d6","versionType":"git","status":"affected"},{"version":"6.6.143","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.12.93","lessThan":"6.12.111","versionType":"semver","status":"affected"},{"version":"6.18.3","lessThan":"6.18.53","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/inet_fragment.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/7cb5f4643a7fcdbfbee1fad3cdfc678add62d378","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b824476c56a153934c67c9e0f873e1fd967743d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9d77f1652e79e58eac48430d0431c329137efcc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf3d6c44c84c57e8a4bb7f40ad95b64f9b0198ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff83367cda8eefbd62007ef1dff4f8104226d18a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97603","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:13.393","lastModified":"2026-10-19T10:17:30.133","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: disable DIM work before freeing q_vectors\n\nidpf never drains the Tx/Rx DIM works before freeing the memory they\nlive in.  tx_dim and rx_dim are embedded in struct idpf_q_vector, they\nare queued from the NAPI poll via net_dim(), and idpf_vport_intr_rel()\nends with kfree(rsrc->q_vectors).  Nothing in the driver cancels them.\n\nidpf_tx_dim_work() and idpf_rx_dim_work() then run on freed memory:\nidpf_vport_intr_write_itr() writes the ITR register through\nq_vector->intr_reg.tx_itr / rx_itr, void __iomem pointers loaded out of\nthe freed q_vector.  No configuration is needed to get there --\nIDPF_ITR_IS_DYNAMIC() is defined as (itr_mode) and idpf_vport_alloc()\ninitialises both modes to IDPF_ITR_DYNAMIC.\n\nDraining after idpf_vport_intr_napi_dis_all() is not enough on its own.\nidpf_net_dim() is called from inside the\n\"if (napi_complete_done(napi, work_done))\" branch of the poll, and\nnapi_complete_done() has already cleared NAPIF_STATE_SCHED by then.\nnapi_disable_locked() waits only while (val & (NAPIF_STATE_SCHED |\nNAPIF_STATE_NPSVC)), so napi_disable() can return while the poll tail is\nstill queueing the work, and a plain cancel_work_sync() would be\nre-armed behind the drain.\n\nUse disable_work_sync(): schedule_work() on a work with a non-zero\ndisable count is dropped by clear_pending_if_disabled() before\n__queue_work() is reached.\n\nMove idpf_init_dim() to idpf_vport_intr_alloc() so the works are\ninitialised on every path that can reach the drain -- the three\n\"goto intr_deinit\" sites between idpf_vport_intr_init() and\nidpf_vport_intr_ena() get there without the enable side having run.\nNothing re-enables them: rsrc->q_vectors is freed on every exit from\nidpf_vport_open() and on every idpf_vport_stop(), so the count dies with\nthe object.\n\nIt is a race, not a deterministic failure -- net_dim() only schedules\nonce DIM_NEVENTS events have accumulated and the profile index changes.\nA KASAN ifup/ifdown loop under load is the way to see it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/intel/idpf/idpf_txrx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c2d548cad1508d334517bcbd7cd5c915cc831fc0","lessThan":"7d64d4c6bb6bb63b6cdb7de133c3ec48333b27b5","versionType":"git","status":"affected"},{"version":"c2d548cad1508d334517bcbd7cd5c915cc831fc0","lessThan":"7e4312953788244d47074987d40d76702cf929f1","versionType":"git","status":"affected"},{"version":"c2d548cad1508d334517bcbd7cd5c915cc831fc0","lessThan":"cd7a1598645b6917a8676b7e2efe8d97ce68a952","versionType":"git","status":"affected"},{"version":"c2d548cad1508d334517bcbd7cd5c915cc831fc0","lessThan":"7dd4c829bac2916be98a3e34b41daaba7f42b4c4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/intel/idpf/idpf_txrx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/7d64d4c6bb6bb63b6cdb7de133c3ec48333b27b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7dd4c829bac2916be98a3e34b41daaba7f42b4c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e4312953788244d47074987d40d76702cf929f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cd7a1598645b6917a8676b7e2efe8d97ce68a952","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97604","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:14.407","lastModified":"2026-10-19T10:17:30.253","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: vfb: defer cleanup until the last reference\n\nFBIOGETCMAP takes a shallow snapshot of info->cmap and performs the\nusercopy after dropping info->lock. vfb_remove() frees the colormap\nimmediately after unregistering the framebuffer, even when an open file\nstill holds a reference to fb_info. A concurrent driver unbind can\ntherefore free the colormap while the ioctl copies it to userspace.\n\nKASAN reports:\n\n  BUG: KASAN: slab-use-after-free in _copy_to_user\n  Read of size 512 by task poc/125\n\n   _copy_to_user (./include/linux/instrumented.h:129 ./include/linux/uaccess.h:201 lib/usercopy.c:24)\n   fb_cmap_to_user (./include/linux/uaccess.h:230 drivers/video/fbdev/core/fbcmap.c:211)\n   do_fb_ioctl (drivers/video/fbdev/core/fb_chrdev.c:114)\n\n   Allocated by task 1:\n   fb_alloc_cmap_gfp (./include/linux/slab.h:973 ./include/linux/slab.h:1290 drivers/video/fbdev/core/fbcmap.c:108)\n   vfb_probe (drivers/video/fbdev/vfb.c:459)\n\n   Freed by task 124:\n   fb_dealloc_cmap (drivers/video/fbdev/core/fbcmap.c:151)\n   vfb_remove (drivers/video/fbdev/vfb.c:489)\n\nunregister_framebuffer() drops the registration reference, and fbdev calls\nfb_destroy after the last put_fb_info(). Move the registered framebuffer's\ncleanup into an fb_destroy callback so its colormap and screen buffer stay\nalive until all file references have been released."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/video/fbdev/vfb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a","lessThan":"bf49eac7ed11aabd0b9b790c062742a8e4be97c6","versionType":"git","status":"affected"},{"version":"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a","lessThan":"040ce3950f64a11e9ee5646c8aaa91fd2e29e245","versionType":"git","status":"affected"},{"version":"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a","lessThan":"ab664e279eb2a68e55895dd115a9488807280f07","versionType":"git","status":"affected"},{"version":"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a","lessThan":"de5a0eda59fe4b3eacd1a67c992e54766bb6683f","versionType":"git","status":"affected"},{"version":"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a","lessThan":"86356f13598f59f5acb1754895747dcdaf65a254","versionType":"git","status":"affected"},{"version":"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a","lessThan":"5ff1effb047e465cde193d7df95988aa1520035e","versionType":"git","status":"affected"},{"version":"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a","lessThan":"3c91e51a53cf805e551e5dc8149cd0539a6dbb9d","versionType":"git","status":"affected"},{"version":"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a","lessThan":"a0a34a40ed299c9c7cff6af163a5b883ee9d6d73","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/video/fbdev/vfb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","lessThan":"2.6.30","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/040ce3950f64a11e9ee5646c8aaa91fd2e29e245","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3c91e51a53cf805e551e5dc8149cd0539a6dbb9d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ff1effb047e465cde193d7df95988aa1520035e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/86356f13598f59f5acb1754895747dcdaf65a254","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0a34a40ed299c9c7cff6af163a5b883ee9d6d73","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab664e279eb2a68e55895dd115a9488807280f07","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf49eac7ed11aabd0b9b790c062742a8e4be97c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de5a0eda59fe4b3eacd1a67c992e54766bb6683f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97605","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:14.543","lastModified":"2026-10-21T13:21:14.713","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: preserve LZMA decoders on resize failure\n\nThe pool-resize path frees each stream's old decoder before allocating\nits replacement. If an allocation fails after some streams have already\nbeen replaced, the failed stream is put back on the list with state ==\nNULL. z_erofs_lzma_max_dictsize is still advanced as if the whole\npool had been resized.\n\nAn existing LZMA mount can select the broken stream and pass\nNULL to xz_dec_microlzma_reset(). A retry at the same size also\nskip another resize attempt. Since the global maximum was advanced,\nthus, the invalid state is left unrepaired.\n\nAllocate each replacement before freeing the old decoder, temporarily\nretaining one old decoder during allocation. Stop at the first failure\nand advance z_erofs_lzma_max_dictsize only after all streams satisfy\nthe request.\n\nRecord each stream's dictionary capacity so retries can skip streams\nalready enlarged before a partial failure."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/erofs/decompressor_lzma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"622ceaddb7649ca328832f50ba1400af778d75fa","lessThan":"db0c3465b54a16debc089b2b3bda251d26c953d0","versionType":"git","status":"affected"},{"version":"622ceaddb7649ca328832f50ba1400af778d75fa","lessThan":"604ce546e1b9f35b1f45588004f53fac6b2869c1","versionType":"git","status":"affected"},{"version":"622ceaddb7649ca328832f50ba1400af778d75fa","lessThan":"0b3c8c39e50249470f00a5f73c288b95a55ab576","versionType":"git","status":"affected"},{"version":"622ceaddb7649ca328832f50ba1400af778d75fa","lessThan":"38e9e07ac02a9453a117410776f1502a9980997e","versionType":"git","status":"affected"},{"version":"622ceaddb7649ca328832f50ba1400af778d75fa","lessThan":"617d0d8d199ba1790c94310fd75a22d01c97a8d6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/erofs/decompressor_lzma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0b3c8c39e50249470f00a5f73c288b95a55ab576","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38e9e07ac02a9453a117410776f1502a9980997e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/604ce546e1b9f35b1f45588004f53fac6b2869c1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/617d0d8d199ba1790c94310fd75a22d01c97a8d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db0c3465b54a16debc089b2b3bda251d26c953d0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97606","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:14.657","lastModified":"2026-10-19T10:17:30.503","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs: autofs: fix memory leak in autofs_fill_super()\n\nIn autofs_fill_super(), we create a new inode using\nautofs_new_ino(), however, if we fail to create root_inode,\n(that is, root_inode failure path), we return -ENOMEM without\nfreeing the new inode(ino) that we created causing a memory leak.\nFix this by adding autofs_free_ino() to free the inode we created\nin root_inode failure path before returning ENOMEM."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/autofs/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"66917f85db6002ed09cd24186258892fcfca64b6","lessThan":"4262b91e08e74cb5209ea737c554cf983d332382","versionType":"git","status":"affected"},{"version":"66917f85db6002ed09cd24186258892fcfca64b6","lessThan":"9933ad1c4ff67680cd59c47f6d2e81b533bcd467","versionType":"git","status":"affected"},{"version":"66917f85db6002ed09cd24186258892fcfca64b6","lessThan":"6259b5d9bdc45fdb3158406b28c27fa074823159","versionType":"git","status":"affected"},{"version":"66917f85db6002ed09cd24186258892fcfca64b6","lessThan":"5ab54837fce04a1c9923d0bfd3d5de51fdc768b3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/autofs/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4262b91e08e74cb5209ea737c554cf983d332382","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ab54837fce04a1c9923d0bfd3d5de51fdc768b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6259b5d9bdc45fdb3158406b28c27fa074823159","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9933ad1c4ff67680cd59c47f6d2e81b533bcd467","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97607","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:14.763","lastModified":"2026-10-19T10:17:30.610","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: ifcvf: Put device on unsupported feature error\n\nRoute unsupported provisioned features through the common error path after\nvdpa_alloc_device() so the allocated device and adapter pointer are\nreleased consistently."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/vdpa/ifcvf/ifcvf_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"46fc0917bbabb1d5efdf8b903728b9f7fc484ce8","lessThan":"123acfd63d7677232a5ba2d9761c9045243ea3e2","versionType":"git","status":"affected"},{"version":"46fc0917bbabb1d5efdf8b903728b9f7fc484ce8","lessThan":"2d7b5fbc7180dc9a0d105b97390422a11ccfe9cd","versionType":"git","status":"affected"},{"version":"46fc0917bbabb1d5efdf8b903728b9f7fc484ce8","lessThan":"5ae2dab5d88e527cd55e9dc642f39a2993e81754","versionType":"git","status":"affected"},{"version":"46fc0917bbabb1d5efdf8b903728b9f7fc484ce8","lessThan":"816fd60fea5d58944086c1fc5587daa71f3d929f","versionType":"git","status":"affected"},{"version":"46fc0917bbabb1d5efdf8b903728b9f7fc484ce8","lessThan":"4d470be71196ca0ce302e6623454533dc31b465b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/vdpa/ifcvf/ifcvf_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/123acfd63d7677232a5ba2d9761c9045243ea3e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2d7b5fbc7180dc9a0d105b97390422a11ccfe9cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4d470be71196ca0ce302e6623454533dc31b465b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ae2dab5d88e527cd55e9dc642f39a2993e81754","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/816fd60fea5d58944086c1fc5587daa71f3d929f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97608","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:14.870","lastModified":"2026-10-19T10:17:30.720","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_log: unregister loggers before per-net teardown\n\nnf_log_syslog and nfnetlink_log unregister their per-network namespace\noperations before unregistering their global logger backends. This\nleaves a window where a sysctl or netlink writer can rebind the still-\nregistered logger after the per-net pre-exit callback cleared the old\nselection.\n\nThe race looks like this:\n\n  CPU 0                                 CPU 1\n  ----                                  ----\n  unregister_pernet_subsys()\n    nf_log_unset(net, logger)\n      net->nf.nf_loggers[pf] = NULL\n\n                                        lock nf_log_mutex\n                                        find logger in loggers[][]\n                                        net->nf.nf_loggers[pf] = logger\n                                        unlock nf_log_mutex\n\n  nf_log_unregister(logger)\n    lock nf_log_mutex\n    loggers[pf][type] = NULL\n    unlock nf_log_mutex\n    synchronize_rcu()\n  module exit returns\n  module core frees backend memory\n\nLater, a sysctl read or packet logging operation can dereference the\nstale per-net logger pointer.\n\nFix this by unregistering the global logger backends before tearing down\nper-net state. Once the global registrations are gone, later writers can\nno longer rebind the logger. unregister_pernet_subsys() already waits\nfor an RCU grace period after the pre-exit callback clears the per-net\nselection, while nf_log_unregister() continues to cover readers of the\nglobal logger table.\n\nApply this ordering fix to both nf_log backends that combine per-net\nteardown with global logger registration."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nf_log_syslog.c","net/netfilter/nfnetlink_log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5b023fc8d8e0997e0b7ea6506d243afd5478c96e","lessThan":"51417230716b73f6aa1dc402b3a56d3382a694dc","versionType":"git","status":"affected"},{"version":"5b023fc8d8e0997e0b7ea6506d243afd5478c96e","lessThan":"b0514ca1ee6f2b708d6c602ea946acdfc6a90e24","versionType":"git","status":"affected"},{"version":"5b023fc8d8e0997e0b7ea6506d243afd5478c96e","lessThan":"90166834b7dc6131aa42b6b14b8b4ed47be97079","versionType":"git","status":"affected"},{"version":"5b023fc8d8e0997e0b7ea6506d243afd5478c96e","lessThan":"eaec35fae8f2052c1878a5c7cc7699d8357d79f2","versionType":"git","status":"affected"},{"version":"5b023fc8d8e0997e0b7ea6506d243afd5478c96e","lessThan":"64803ba0a05791cf9ca874466480e4c4cadaf7ab","versionType":"git","status":"affected"},{"version":"5b023fc8d8e0997e0b7ea6506d243afd5478c96e","lessThan":"dce24f3a146948595bb1b86347f31e20b4975daa","versionType":"git","status":"affected"},{"version":"5b023fc8d8e0997e0b7ea6506d243afd5478c96e","lessThan":"2c018cc4842c33f0c732962e2ab58635e8ae5823","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/nf_log_syslog.c","net/netfilter/nfnetlink_log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.10","status":"affected"},{"version":"0","lessThan":"3.10","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2c018cc4842c33f0c732962e2ab58635e8ae5823","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/51417230716b73f6aa1dc402b3a56d3382a694dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64803ba0a05791cf9ca874466480e4c4cadaf7ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/90166834b7dc6131aa42b6b14b8b4ed47be97079","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0514ca1ee6f2b708d6c602ea946acdfc6a90e24","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dce24f3a146948595bb1b86347f31e20b4975daa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eaec35fae8f2052c1878a5c7cc7699d8357d79f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97609","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:14.987","lastModified":"2026-10-21T13:21:14.830","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: cttimeout: prevent UAF during module unload\n\nnf_ct_set_timeout() protects the timeout hook dereference and policy lookup\nwith rcu_read_lock(). cttimeout_exit(), however, unregisters the per-net\noperations before it clears the hook.\n\nThis allows the following interleaving:\n\n  CPU 0                              CPU 1\n  cttimeout_exit()                   nf_ct_set_timeout()\n    unregister_pernet_subsys()         rcu_read_lock()\n      kfree(pernet)                     h = nf_ct_timeout_hook\n                                        h->timeout_find_get()\n                                          nfct_timeout_pernet()\n\nThe hook still points to ctnl_timeout_find_get() when CPU 1 looks up the\nalready freed per-net timeout list. KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in ctnl_timeout_find_get\n  Read of size 8 by task poc/90\n  Call Trace:\n   ctnl_timeout_find_get+0x271/0x2a0 [nfnetlink_cttimeout]\n   nf_ct_set_timeout+0x7b/0x3c0\n   xt_ct_tg_check+0x724/0xb20\n   xt_check_target+0x234/0xa90\n   do_ipt_set_ctl+0x570/0x1270\n  Allocated by task 89:\n   __kmalloc_noprof+0x16e/0x460\n   ops_init+0x6d/0x420\n   register_pernet_operations+0x2f6/0x670\n  Freed by task 91:\n   kfree+0x131/0x390\n   ops_undo_list+0x3d4/0x730\n   unregister_pernet_operations+0x232/0x490\n   unregister_pernet_subsys+0x1c/0x30\n   cttimeout_exit+0x52/0x970 [nfnetlink_cttimeout]\n\nClear the hook and wait for existing readers before unregistering the\nper-net operations. This blocks new policy lookups and ensures readers that\nobserved the hook finish before the per-net storage is freed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nfnetlink_cttimeout.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ebfbe67568a734a449203097b02c4ab884257535","lessThan":"f664e06699829a31e95675a6864655a6c5f9904f","versionType":"git","status":"affected"},{"version":"ebfbe67568a734a449203097b02c4ab884257535","lessThan":"73f353bec62509c776184e49a031c6145cec0d05","versionType":"git","status":"affected"},{"version":"ebfbe67568a734a449203097b02c4ab884257535","lessThan":"a7fdd86c386b7f7cc72a126389c2cdb55d035221","versionType":"git","status":"affected"},{"version":"ebfbe67568a734a449203097b02c4ab884257535","lessThan":"1f69c570a73f2dedf75ea5166d47622d5fa958c1","versionType":"git","status":"affected"},{"version":"ebfbe67568a734a449203097b02c4ab884257535","lessThan":"fec9b1de0d02de8dafa3cc344bcb91cf28660643","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/nfnetlink_cttimeout.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1f69c570a73f2dedf75ea5166d47622d5fa958c1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/73f353bec62509c776184e49a031c6145cec0d05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a7fdd86c386b7f7cc72a126389c2cdb55d035221","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f664e06699829a31e95675a6864655a6c5f9904f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fec9b1de0d02de8dafa3cc344bcb91cf28660643","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97610","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:15.100","lastModified":"2026-10-19T10:17:31.027","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix uninitialized return value in netfs_unbuffered_write()\n\nIf preparation of the first subrequest fails,\nnetfs_unbuffered_write() exits its loop before ret is initialized. The\nempty-iterator check can do the same.\n\nFor synchronous writes, netfs_unbuffered_write_iter_locked() may then\nreturn an unrelated error instead of wreq->error. This is reachable\nthrough CIFS if cifs_prepare_write() fails to reopen the file or obtain\ncredits.\n\nInitialize ret to 0 so the caller returns wreq->error if no data was\nwritten, or the number of bytes already written otherwise.\n\nFound with Clang's -Wconditional-uninitialized."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/netfs/direct_write.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"72d08d2839649d1c5efbe375751f4473fa4486af","lessThan":"3d038eebdbd400c3bc4b66bd8aa0dff0c2bcce26","versionType":"git","status":"affected"},{"version":"a0b4c7a49137ed21279f354eb59f49ddae8dffc2","lessThan":"2e38d500471d097cda87d7d374bbc1b13493075d","versionType":"git","status":"affected"},{"version":"a0b4c7a49137ed21279f354eb59f49ddae8dffc2","lessThan":"f18e8774f4d3137fa0a5fb8ffa83d59a719666d8","versionType":"git","status":"affected"},{"version":"0c29f6d63122a0168d67cb8ecde5b4cf7fe4acb0","versionType":"git","status":"affected"},{"version":"6.18.17","lessThan":"6.18.53","versionType":"semver","status":"affected"},{"version":"6.19.7","lessThan":"6.20","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/netfs/direct_write.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2e38d500471d097cda87d7d374bbc1b13493075d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3d038eebdbd400c3bc4b66bd8aa0dff0c2bcce26","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f18e8774f4d3137fa0a5fb8ffa83d59a719666d8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97611","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:15.213","lastModified":"2026-10-19T10:17:31.140","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix use-after-free of the flow table mask array\n\ntbl_mask_array_realloc() retires the old mask_array before it stops being\nreachable:\n\n\told = ovsl_dereference(tbl->mask_array);\n\tif (old) {\n\t\t...\n\t\tcall_rcu(&old->rcu, mask_array_rcu_cb);\n\t}\n\n\trcu_assign_pointer(tbl->mask_array, new);\n\ncall_rcu() only waits for read-side critical sections already in flight.\ntbl->mask_array still points at old between the call_rcu() and the\nrcu_assign_pointer(), so a reader entering ovs_flow_tbl_lookup_stats() in\nthat window picks up old in a fresh critical section that the pending\ngrace period does not cover.\n\ntbl_mask_array_realloc() runs in process context under ovs_mutex, so the\nwindow is preemptible and can outlast the grace period. Then\nmask_array_rcu_cb() frees old before the swap runs:\n\n  BUG: KASAN: slab-use-after-free in flow_lookup.constprop.0+0x2bf/0x2f0\n  Read of size 8 at addr ffff888020b3e018 by task poc/741\n   flow_lookup.constprop.0+0x2bf/0x2f0\n   ovs_flow_tbl_lookup_stats+0x4a3/0x5c0\n   ovs_dp_process_packet+0x19c/0x710\n   ovs_vport_receive+0x243/0x390\n   internal_dev_xmit+0x81/0x170\n  Freed by task 728:\n   kfree+0x16a/0x4e0\n   rcu_core+0x853/0x1030\n\nPublish the new array before retiring the old one. The kfree_rcu() that\ncall_rcu() replaced ran after the swap."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/openvswitch/flow_table.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"eac87c413bf9794c14d488998a5265ea5b32f04e","lessThan":"4c98b492e9ed63f9ca3e23566d9a6a4f235944f4","versionType":"git","status":"affected"},{"version":"eac87c413bf9794c14d488998a5265ea5b32f04e","lessThan":"4016ead17acd75312c066ecd47c4b7f0a81ceaa2","versionType":"git","status":"affected"},{"version":"eac87c413bf9794c14d488998a5265ea5b32f04e","lessThan":"017dbbf0d6c319a487f68e22f56d91fc787d5525","versionType":"git","status":"affected"},{"version":"eac87c413bf9794c14d488998a5265ea5b32f04e","lessThan":"76678217cdabc41e3c74c23b45b62086ffb8fe7a","versionType":"git","status":"affected"},{"version":"eac87c413bf9794c14d488998a5265ea5b32f04e","lessThan":"cd982e11684def5d4a9fcfd5354de09032828414","versionType":"git","status":"affected"},{"version":"eac87c413bf9794c14d488998a5265ea5b32f04e","lessThan":"a0d18d21d48a551f82ee344e50efb8a682161489","versionType":"git","status":"affected"},{"version":"eac87c413bf9794c14d488998a5265ea5b32f04e","lessThan":"035e9c3722067648a99010711d0ce81f42572ef4","versionType":"git","status":"affected"},{"version":"eac87c413bf9794c14d488998a5265ea5b32f04e","lessThan":"ba4ba11ed6eb8972c69070417fc27b48deb002e8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/openvswitch/flow_table.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.9","status":"affected"},{"version":"0","lessThan":"5.9","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/017dbbf0d6c319a487f68e22f56d91fc787d5525","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/035e9c3722067648a99010711d0ce81f42572ef4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4016ead17acd75312c066ecd47c4b7f0a81ceaa2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c98b492e9ed63f9ca3e23566d9a6a4f235944f4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/76678217cdabc41e3c74c23b45b62086ffb8fe7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0d18d21d48a551f82ee344e50efb8a682161489","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba4ba11ed6eb8972c69070417fc27b48deb002e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cd982e11684def5d4a9fcfd5354de09032828414","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97612","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:15.330","lastModified":"2026-10-19T10:17:31.307","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mpls: clear inner_protocol when the last label is popped\n\nskb_mpls_push() records the pre-encapsulation network header once, gated\non !skb->inner_protocol. skb_mpls_pop() never clears that record, so it\noutlives the encapsulation it describes.\n\nOpen vSwitch can then re-push MPLS onto a packet whose\ninner_network_header still points at the older, deeper offset: push a\nlabel, pop every label, recirculate (ovs_flow_key_update() re-derives\nkey->eth.type and resets network_header, but leaves inner_*), then push\nagain. ovs_fragment() trusts the record:\n\n\tskb->network_header = skb->inner_network_header;\n\nso skb_network_offset() goes negative. The bound check is signed:\n\n\tif (skb_network_offset(skb) > MAX_L2_LEN)\n\na negative offset passes it, and prepare_frag() widens the value:\n\n\tunsigned int hlen = skb_network_offset(skb);\n\tmemcpy(&data->l2_data, skb->data, hlen);\n\nwhich is a ~4GiB memcpy out of a 30-byte per-CPU buffer.\n\nReproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8):\n\n  BUG: unable to handle page fault for address: ffffe8ffffc16000\n  #PF: supervisor write access in kernel mode\n  Oops: 0002 [#1] SMP KASAN NOPTI\n  RIP: 0010:memcpy+0x8/0x20\n  RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000\n   prepare_frag+0x3df/0x4e0\n   ovs_fragment+0x589/0x7e0\n   do_output+0x4ce/0x5e0\n   do_execute_actions+0x55d2/0x7b30\n   ovs_execute_actions+0xea/0x450\n\nSame root-cause shape as commit 975b5b067f52 (\"ipv6: sr: restore network\nheader before routing and forwarding\"): a stale network header offset\nreaching a consumer that widens it. Here it originates in the MPLS\npush/pop path.\n\nClear inner_protocol once the packet is no longer MPLS, so a later push\nre-records the current header. net/sched/act_mpls.c is the only other\nskb_mpls_pop() caller and gets the same fix; sch_frag.c saves and\nrestores inner_protocol around fragmentation in the same way OVS does."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/core/skbuff.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"48d2ab609b6bbecb7698487c8579bc40de9d6dfa","lessThan":"55ed97db27bffe29c21fdefd5d25601322c36ff8","versionType":"git","status":"affected"},{"version":"48d2ab609b6bbecb7698487c8579bc40de9d6dfa","lessThan":"833ec2788322306407503b4cfc7745cd1f9d785f","versionType":"git","status":"affected"},{"version":"48d2ab609b6bbecb7698487c8579bc40de9d6dfa","lessThan":"38db09804b2616aa1e2fcdf97f0c3ae8b9dbdd34","versionType":"git","status":"affected"},{"version":"48d2ab609b6bbecb7698487c8579bc40de9d6dfa","lessThan":"0b3425fd0ecd515997956f7bb8a8a576b444ed64","versionType":"git","status":"affected"},{"version":"48d2ab609b6bbecb7698487c8579bc40de9d6dfa","lessThan":"011e17b5cae19b9f6a150923275e41c278de64f0","versionType":"git","status":"affected"},{"version":"48d2ab609b6bbecb7698487c8579bc40de9d6dfa","lessThan":"da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e","versionType":"git","status":"affected"},{"version":"48d2ab609b6bbecb7698487c8579bc40de9d6dfa","lessThan":"b39120523475d6b436be7f6cb27d48064148a327","versionType":"git","status":"affected"},{"version":"48d2ab609b6bbecb7698487c8579bc40de9d6dfa","lessThan":"78a86d75a70e1e227711c72865c59b1422d0a5ae","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/core/skbuff.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/011e17b5cae19b9f6a150923275e41c278de64f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0b3425fd0ecd515997956f7bb8a8a576b444ed64","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38db09804b2616aa1e2fcdf97f0c3ae8b9dbdd34","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55ed97db27bffe29c21fdefd5d25601322c36ff8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78a86d75a70e1e227711c72865c59b1422d0a5ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/833ec2788322306407503b4cfc7745cd1f9d785f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b39120523475d6b436be7f6cb27d48064148a327","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97613","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:15.453","lastModified":"2026-10-19T10:17:31.467","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Reserve extra CQ slot for the fence completion CQE\n\nThe RX completion queue is sized to hold exactly one CQE per posted RX WQE.\nMANA_FENCE_RQ makes hardware post an additional CQE_RX_OBJECT_FENCE after\nthe packet CQEs. The current sizing reserves no extra slot for it and in\nrare cases, CQ has no guaranteed slot for the fence CQE when it is full of\npacket CQEs. This can lead to dropping the fence completion while the\ndriver waits holding RTNL lock throughout the timeout duration.\nReserve one extra CQE slot for CQE_RX_OBJECT_FENCE. mana_gd_alloc_memory()\nrequires queue_size to be a power-of-two and at least MANA_PAGE_SIZE;\nthe reservation pushes cq_size past a power-of-two, so round up the CQ size\nin mana_create_rxq()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/microsoft/mana/mana_en.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6cc74443a7732d7e93bee3d0c3704a22cc7274d9","lessThan":"f7d76b84b9206eef4320d8ab715d65f944535acf","versionType":"git","status":"affected"},{"version":"6cc74443a7732d7e93bee3d0c3704a22cc7274d9","lessThan":"62eb52454afcc1d390b8624c5d1ddc92cf382f39","versionType":"git","status":"affected"},{"version":"6cc74443a7732d7e93bee3d0c3704a22cc7274d9","lessThan":"1e43c407624d2111c19d4d8ffe9b2191a0ec42de","versionType":"git","status":"affected"},{"version":"6cc74443a7732d7e93bee3d0c3704a22cc7274d9","lessThan":"6c739cb89ebd6cf225dac46d2721e11927a7ead4","versionType":"git","status":"affected"},{"version":"6cc74443a7732d7e93bee3d0c3704a22cc7274d9","lessThan":"80dd7e754b3aa9637a0758ad93fa209f9650ec48","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/microsoft/mana/mana_en.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.17","status":"affected"},{"version":"0","lessThan":"5.17","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1e43c407624d2111c19d4d8ffe9b2191a0ec42de","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62eb52454afcc1d390b8624c5d1ddc92cf382f39","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6c739cb89ebd6cf225dac46d2721e11927a7ead4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/80dd7e754b3aa9637a0758ad93fa209f9650ec48","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f7d76b84b9206eef4320d8ab715d65f944535acf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97614","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:15.563","lastModified":"2026-10-19T10:17:31.580","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: tag_brcm: legacy FCS: request needed tailroom\n\nThe legacy FCS tagger calculates the CRC over skb->len bytes starting at\nskb->data. When a nonlinear skb reaches the tagger, this reads past the\nlinear head into unrelated slab memory.\n\nThe tagger appends an Ethernet FCS but does not declare that tailroom. As a\nresult, DSA leaves NETIF_F_SG and NETIF_F_FRAGLIST enabled on the user\nport, and nonlinear skbs can reach the CRC calculation.\n\nDeclare the required tailroom. DSA will then clear those features and the\nnetworking core will linearize skbs before the tagger runs.\n\nA KASAN-enabled dsa_loop test using this tagger reports:\n\n  BUG: KASAN: slab-out-of-bounds in crc32_le\n  Read of size 1 at addr ffff8880397086c0 by task exp/135\n\n  Call Trace:\n   crc32_le (lib/crc/crc32-main.c:38)\n   brcm_leg_fcs_tag_xmit (net/dsa/tag_brcm.c:343)\n   dsa_user_xmit (net/dsa/user.c:942)\n   dev_hard_start_xmit (net/core/dev.c:3937)\n   __dev_queue_xmit (net/core/dev.c:4926)\n   packet_sendmsg (net/packet/af_packet.c:3110)\n   __sys_sendto (net/socket.c:2281)\n\n  The buggy address belongs to the object at ffff888039708400\n   which belongs to the cache skbuff_small_head of size 704\n  The buggy address is located 0 bytes to the right of\n   allocated 704-byte region [ffff888039708400, ffff8880397086c0)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/dsa/tag_brcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ef07df397a621707903ef0d294a7df11f80cf206","lessThan":"709451db123d90743fa9104b48f324a8e49f8c6f","versionType":"git","status":"affected"},{"version":"ef07df397a621707903ef0d294a7df11f80cf206","lessThan":"3eb5c7e1c154c74568620a25c6751bb8d6d8d728","versionType":"git","status":"affected"},{"version":"ef07df397a621707903ef0d294a7df11f80cf206","lessThan":"5be081b83abd3f17d908953b4bb77279f5a149e3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/dsa/tag_brcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3eb5c7e1c154c74568620a25c6751bb8d6d8d728","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5be081b83abd3f17d908953b4bb77279f5a149e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/709451db123d90743fa9104b48f324a8e49f8c6f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97615","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:15.670","lastModified":"2026-10-21T13:21:14.970","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: use option bits for CFM/MRP frame handlers\n\nCFM and MRP register a global br_frame_type whose hlist_node is linked\ninto the per-bridge frame_type_list when the first MEP/MRP instance is\ncreated. Enabling the protocol on multiple bridges therefore inserts the\nsame node into multiple lists. Unregistering it on one bridge then\ncorrupts list state belonging to another.\n\nThese handlers can only be installed once per bridge, and they are\nuncommon. Track their per-bridge enable state with net_bridge option\nbits, which already live on the Rx hot cache line, and dispatch the\nmatching handler directly from the receive path. Check both bits\ntogether first as an unlikely case.\n\nRemove the generic frame_type_list and br_frame_type helpers, which\nhave had no other users since CFM and MRP were added. That shrinks\nstruct net_bridge by 8 bytes and drops the list walk from the fast\npath. When neither protocol is compiled in, BR_CFM_MRP_OPTS is 0 and\nthe compiler prunes the branch."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bridge/br_cfm.c","net/bridge/br_device.c","net/bridge/br_input.c","net/bridge/br_mrp.c","net/bridge/br_private.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"90c628dd47ff4178f645b34938470bf43d02d123","lessThan":"260f99b355a44f6ce67971ebc9223b22c8f93957","versionType":"git","status":"affected"},{"version":"90c628dd47ff4178f645b34938470bf43d02d123","lessThan":"be5ead6552418d70df3a76b962ccd6ed78a31fb5","versionType":"git","status":"affected"},{"version":"90c628dd47ff4178f645b34938470bf43d02d123","lessThan":"994fd705ca498223d188024cde833739a9dddbd2","versionType":"git","status":"affected"},{"version":"90c628dd47ff4178f645b34938470bf43d02d123","lessThan":"42e033c8f30fd2923ccac3373ae70797e521dae1","versionType":"git","status":"affected"},{"version":"90c628dd47ff4178f645b34938470bf43d02d123","lessThan":"7a49e6b16f36b8e085521699adbca3e321b6dd0c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bridge/br_cfm.c","net/bridge/br_device.c","net/bridge/br_input.c","net/bridge/br_mrp.c","net/bridge/br_private.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/260f99b355a44f6ce67971ebc9223b22c8f93957","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42e033c8f30fd2923ccac3373ae70797e521dae1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a49e6b16f36b8e085521699adbca3e321b6dd0c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/994fd705ca498223d188024cde833739a9dddbd2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be5ead6552418d70df3a76b962ccd6ed78a31fb5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97616","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:15.780","lastModified":"2026-10-21T13:21:15.080","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_api: release all action references on NEWACTION failure\n\nWhen a batched RTM_NEWACTION request replaces an existing action,\ntcf_idr_check_alloc() takes a temporary reference on it. If a later\naction fails to initialize, tcf_action_destroy() uses strict release\nsemantics to clean up the actions initialized so far. For an action\nbound to a filter, the strict check returns -EPERM without dropping\nthe temporary reference.\n\nThis error also makes tcf_action_destroy() return before releasing\nsubsequent entries. Any new action initialized between the bound\naction and the failing entry is leaked together with its reserved\nIDR slot, preventing reuse of its index.\n\nUse tcf_idr_release() to drop each reference held by the batch without\nrejecting bound actions. This allows cleanup to continue through all\ninitialized entries and preserves the module reference release when\nan action is destroyed. Explicit action deletion and flushing retain\ntheir separate bind-count checks."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sched/act_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"55334a5db5cd32b207ac697cec3ec8e078f345d4","lessThan":"1b5730a1c7def8993b3feba764008d1ff5c9dcea","versionType":"git","status":"affected"},{"version":"55334a5db5cd32b207ac697cec3ec8e078f345d4","lessThan":"f908c8a969946a45225fd7f9d9a85771e12ae0a8","versionType":"git","status":"affected"},{"version":"55334a5db5cd32b207ac697cec3ec8e078f345d4","lessThan":"64b36eaef6ea5ada9aea4c2cf87099aaa8a4869b","versionType":"git","status":"affected"},{"version":"55334a5db5cd32b207ac697cec3ec8e078f345d4","lessThan":"048617743febf6530111cfb594e9bbbd7918bf67","versionType":"git","status":"affected"},{"version":"55334a5db5cd32b207ac697cec3ec8e078f345d4","lessThan":"478eb5abb51931a152abab068f8a717b7ff480fd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sched/act_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.15","status":"affected"},{"version":"0","lessThan":"3.15","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/048617743febf6530111cfb594e9bbbd7918bf67","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1b5730a1c7def8993b3feba764008d1ff5c9dcea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/478eb5abb51931a152abab068f8a717b7ff480fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64b36eaef6ea5ada9aea4c2cf87099aaa8a4869b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f908c8a969946a45225fd7f9d9a85771e12ae0a8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97617","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:15.893","lastModified":"2026-10-19T10:17:32.230","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Check resize_disabled before publishing the new subbuf order\n\nring_buffer_subbuf_order_set() stores the new order and only then walks\nthe CPUs, returning -EBUSY if any of them has resizing disabled. A user\nmapped buffer has resizing disabled, and __rb_map_vma() reads\nbuffer->subbuf_order without buffer->mutex, so an mmap of an already\nmapped CPU racing the failing order change sizes the mapping with the\nnew order and inserts pages past the sub-buffer into the VMA.\n\nCheck the CPUs before storing the new order."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/ring_buffer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"117c39200d9d760cbd5944bb89efb7b9c51965aa","lessThan":"f2099644e1b2a2c0805c5240d63ab0522d9d0174","versionType":"git","status":"affected"},{"version":"117c39200d9d760cbd5944bb89efb7b9c51965aa","lessThan":"9fd4ea952e6ac12a63c3fe89f08ad02771aa2c06","versionType":"git","status":"affected"},{"version":"117c39200d9d760cbd5944bb89efb7b9c51965aa","lessThan":"32bf47db9237c5b8b6f6aaa5356bb4c79d241f76","versionType":"git","status":"affected"},{"version":"117c39200d9d760cbd5944bb89efb7b9c51965aa","lessThan":"d860c67c051685abb0460b593b193f0f45f4fa92","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/ring_buffer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/32bf47db9237c5b8b6f6aaa5356bb4c79d241f76","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9fd4ea952e6ac12a63c3fe89f08ad02771aa2c06","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d860c67c051685abb0460b593b193f0f45f4fa92","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2099644e1b2a2c0805c5240d63ab0522d9d0174","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97618","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:16.000","lastModified":"2026-10-19T10:17:38.773","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: don't overconsume buffers when using MSG_TRUNC\n\nWhen a recv/recvmsg is issued with MSG_TRUNC and the incoming packet is\nlarger than the provided buffer, the net layer returns the full length\nof the packet rather than the number of bytes actually copied into the\nbuffer.  As a result, io_uring advances more of the provided buffer ring\nthan was actually filled.  Use the actual filled region size to consume\nthe buffer, but still return the full size to preserve MSG_TRUNC\nsemantics.\n\nTake care with multishot, because that seems to already truncate the\nconsumption based on the available payload size.\n\nThis was reported in https://github.com/axboe/liburing/issues/1619.\n\n[axboe: fold in size_t unsigned fix]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["io_uring/net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ae98dbf43d755b4e111fcd086e53939bef3e9a1a","lessThan":"41d24d2fb168fa05fcaf9ec4e55478411dbbf8e1","versionType":"git","status":"affected"},{"version":"ae98dbf43d755b4e111fcd086e53939bef3e9a1a","lessThan":"927d96f91c582b319d104ecf50ec935a8dc29193","versionType":"git","status":"affected"},{"version":"ae98dbf43d755b4e111fcd086e53939bef3e9a1a","lessThan":"2e70ea75c7bb38a6dc212975f887310f14f7c043","versionType":"git","status":"affected"},{"version":"ae98dbf43d755b4e111fcd086e53939bef3e9a1a","lessThan":"6028b543884f8735e057ec9eea4908cd61cab230","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["io_uring/net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2e70ea75c7bb38a6dc212975f887310f14f7c043","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41d24d2fb168fa05fcaf9ec4e55478411dbbf8e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6028b543884f8735e057ec9eea4908cd61cab230","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/927d96f91c582b319d104ecf50ec935a8dc29193","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97619","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:16.117","lastModified":"2026-10-21T13:21:15.190","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/rw: end write accounting from ->ki_complete\n\nCommit b000145e9907 moved both the fsnotify calls and the write\naccounting out of the kiocb completion handler and into the\nio_req_rw_complete() task_work. However, only the fsnotify part actually\nneeded to move as it may sleep. Ending the write accounting is just a\npercpu_up_read() on the superblock writers sem.\n\nDeferring it is a problem, because it makes dropping SB_FREEZE_WRITE\nprotection depend on the ring owner getting to running task_work. But\nthe task may be blocked in freeze_super(), causing it to never get to\nthat:\n\n  task                             io-wq worker\n  --------------------------------------------------------------\n  io_write()\n    io_kiocb_start_write()         (takes sb_writers, hidden from\n                                    lockdep by __sb_writers_release)\n    write_iter() -> -EIOCBQUEUED\n  ioctl(FS_IOC_SHUTDOWN)\n    bdev_freeze()\n      freeze_super()\n        percpu_down_write()        <- waits for the reader above\n                                   io_write()\n                                     kiocb_start_write()\n                                       percpu_down_read()  <- queued\n                                                              behind the\n                                                              writer\n  <bio completes>\n    io_complete_rw()\n      queues io_req_rw_complete()  <- never runs, task is in D state\n\nEnd the write from io_complete_rw() instead, and leave only the fsnotify\ncalls in task_work."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["io_uring/rw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b000145e9907809406d8164c3b2b8861d95aecd1","lessThan":"ed1cead97afb9c398bd7ab344a3c1ee34ab73af9","versionType":"git","status":"affected"},{"version":"b000145e9907809406d8164c3b2b8861d95aecd1","lessThan":"696459029f3b65c070c91b729478475582f1dcdf","versionType":"git","status":"affected"},{"version":"b000145e9907809406d8164c3b2b8861d95aecd1","lessThan":"cc580cee4dfa2ec9099c30ecbd4d804cbb996432","versionType":"git","status":"affected"},{"version":"b000145e9907809406d8164c3b2b8861d95aecd1","lessThan":"055d43a1233edbd80e558889258105ce63051bcd","versionType":"git","status":"affected"},{"version":"b000145e9907809406d8164c3b2b8861d95aecd1","lessThan":"796aa0547557e63338657ed1c487906f9fac4c73","versionType":"git","status":"affected"},{"version":"ea2e6286e3e89a115ae554e20ba9aec2b2e1ddff","versionType":"git","status":"affected"},{"version":"89a410dbd0f159ddd308f19d6eb682fc753e4771","versionType":"git","status":"affected"},{"version":"2a853c206e553dd9c0a55c22858fd6a446d93e15","versionType":"git","status":"affected"},{"version":"5.10.165","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.15.90","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.0.3","lessThan":"6.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["io_uring/rw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/055d43a1233edbd80e558889258105ce63051bcd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/696459029f3b65c070c91b729478475582f1dcdf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/796aa0547557e63338657ed1c487906f9fac4c73","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc580cee4dfa2ec9099c30ecbd4d804cbb996432","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed1cead97afb9c398bd7ab344a3c1ee34ab73af9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97620","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:16.240","lastModified":"2026-10-19T10:17:39.807","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches\n\nemit_render_cache_flush() sets PIPE_CONTROL0_HDC_PIPELINE_FLUSH to\nflush the L2/HDC data cache before fence signalling, but it never\nrequests a flush of the LSC untyped L1 data cache via the 'Untyped\nData-Port Cache Flush Enable' bit in PIPE_CONTROL DWord0[11].\n\nPer the Bspec, in 3D pipeline mode HDC Pipeline Flush is documented to\nalso flush/invalidate the untyped L1 cache, but only depending on how\nHDC_CHICKEN0[13:11] is programmed. Starting with MTL, this coupling\nbetween HDC Pipeline Flush and the untyped L1 cache flush no longer\nholds in practice, regardless of how HDC_CHICKEN0 is programmed, so\nrelying on it is not safe on newer platforms such as BMG. Mesa's Vulkan\ndriver (anv) has been assuming the kernel flushes both caches between\nsubmissions, and hit user-visible corruption in apps such as Llama.cpp\nbecause of this gap; it now works around it by flushing both caches\nagain from userspace at the end of every command buffer.\n\nCorrectness between submissions on the same queue is userspace's\nresponsibility and belongs in Mesa, not the kernel. However, for\nsecurity we must ensure stale data can't leak through the untyped L1\ndataport cache once memory is reclaimed or evicted, which requires the\nKMD to flush it before releasing memory for reuse.\n\nPrior to MTL, HDC_CHICKEN0 could be programmed (as already done for\nDG2 via Wa_22010960976/Wa_14013347512) to reliably keep HDC Pipeline\nFlush coupled to the untyped L1 cache flush, so those platforms are\nunaffected. Mesa's own anv driver found that on MTL the HW\ndisconnected the two independently of how HDC_CHICKEN0 is programmed,\nand could not bring the old behavior back even by writing the register\nby hand; see Mesa commit 7c2ff46a4fc3 (\"anv: don't prevent L1 untyped\ncache flush in 3D mode\"). The kernel can't reliably request the flush\nfrom the CS on MTL either, so restrict the new PIPE_CONTROL bit to\nGRAPHICS_VERx100 >= 2000 (Xe2 and later), where it can be relied on.\n\nExplicitly set PIPE_CONTROL0_UNTYPED_DATAPORT_CACHE_FLUSH together\nwith PIPE_CONTROL0_HDC_PIPELINE_FLUSH in emit_render_cache_flush() on\nXe2 and later, so the L1 data cache is known clean before memory is\nreleased for reuse, without depending on undocumented\nplatform-specific HDC_CHICKEN0 behavior.\n\nBspec: 56551\n(cherry picked from commit 434514b6fe731e873808297c268fc52cdf4a1ce6)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/xe/instructions/xe_gpu_commands.h","drivers/gpu/drm/xe/xe_ring_ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9f8f93bee3efdba3bf7853befe2219e3a300c305","lessThan":"d73975c121f56fe3fcbbfcfe3ea8853b9f597ab3","versionType":"git","status":"affected"},{"version":"9f8f93bee3efdba3bf7853befe2219e3a300c305","lessThan":"fab569a69c3ae9beced68307e36048efa2709bec","versionType":"git","status":"affected"},{"version":"9f8f93bee3efdba3bf7853befe2219e3a300c305","lessThan":"92393fc5227b2b701f2b1530c9cd6dac6ee90b71","versionType":"git","status":"affected"},{"version":"9f8f93bee3efdba3bf7853befe2219e3a300c305","lessThan":"f5fcf7e638b904397ec0f66d3ea6766ef0cfe25b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/xe/instructions/xe_gpu_commands.h","drivers/gpu/drm/xe/xe_ring_ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/92393fc5227b2b701f2b1530c9cd6dac6ee90b71","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d73975c121f56fe3fcbbfcfe3ea8853b9f597ab3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5fcf7e638b904397ec0f66d3ea6766ef0cfe25b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fab569a69c3ae9beced68307e36048efa2709bec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97621","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:16.360","lastModified":"2026-10-19T10:17:39.933","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/rockchip: analogix_dp: fix unchecked bound endpoint name length\n\nrockchip_dp_drm_encoder_enable() uses sprintf() to format a device tree\npath into a 32-byte stack buffer. Device tree paths are not limited to\nthis size, so a sufficiently long path can overflow the buffer.\n\nUse snprintf() with the destination size to truncate the generated name\nand keep the writes within bounds."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/rockchip/analogix_dp-rockchip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"729f8eefdcadaff98606931e691910f17d8d59d6","lessThan":"49f5268f43a791dd0d9ff554cce25a3685c7250b","versionType":"git","status":"affected"},{"version":"729f8eefdcadaff98606931e691910f17d8d59d6","lessThan":"2fcd112caa4ebc64fdcb509f0b26d8daa3fac950","versionType":"git","status":"affected"},{"version":"729f8eefdcadaff98606931e691910f17d8d59d6","lessThan":"bc69439d983cc491cc86e01fafc1deb94e1bb85e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/rockchip/analogix_dp-rockchip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2fcd112caa4ebc64fdcb509f0b26d8daa3fac950","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/49f5268f43a791dd0d9ff554cce25a3685c7250b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc69439d983cc491cc86e01fafc1deb94e1bb85e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97875","sourceIdentifier":"74b3a70d-cca6-4d34-9789-e83b222ae3be","published":"2026-09-25T11:17:16.470","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Rojo's \"rojo serve\" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page."}],"affected":[{"source":"74b3a70d-cca6-4d34-9789-e83b222ae3be","affectedData":[{"vendor":"rojo-rbx","product":"rojo","defaultStatus":"unaffected","collectionURL":"https://crates.io","packageName":"rojo","versions":[{"version":"0","lessThan":"7.7.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"74b3a70d-cca6-4d34-9789-e83b222ae3be","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:38:52.187526Z","id":"CVE-2026-97875","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"74b3a70d-cca6-4d34-9789-e83b222ae3be","type":"Secondary","description":[{"lang":"en","value":"CWE-350"}]}],"references":[{"url":"https://github.com/rojo-rbx/rojo/pull/1270","source":"74b3a70d-cca6-4d34-9789-e83b222ae3be"},{"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0279","source":"74b3a70d-cca6-4d34-9789-e83b222ae3be"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0279.html","source":"74b3a70d-cca6-4d34-9789-e83b222ae3be"}]}},{"cve":{"id":"CVE-2026-97899","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:16.677","lastModified":"2026-10-19T10:17:40.043","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Fix memory leak in query_perf_config_list()\n\nWhen krealloc() fails, free the original oa_config_ids before returning\nto avoid a memory leak.\n\n(cherry picked from commit 9977e9d84f46d4f12ad35fbbc0ec4638554bce87)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/i915/i915_query.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4f6ccc74a85cbb4cdd373c374dc76398dc7603a1","lessThan":"d60532306397233fb860860e9694f4e35abc0e80","versionType":"git","status":"affected"},{"version":"4f6ccc74a85cbb4cdd373c374dc76398dc7603a1","lessThan":"c0c727809229119598b50aba2776d236fbaa7989","versionType":"git","status":"affected"},{"version":"4f6ccc74a85cbb4cdd373c374dc76398dc7603a1","lessThan":"3726824aa1418594a7458721f8b8cafd5393a300","versionType":"git","status":"affected"},{"version":"4f6ccc74a85cbb4cdd373c374dc76398dc7603a1","lessThan":"362c42720259f42abbbafa99a12cd14f74254b7c","versionType":"git","status":"affected"},{"version":"4f6ccc74a85cbb4cdd373c374dc76398dc7603a1","lessThan":"d004303557924077a327d71c80f5863b1b9ff1d7","versionType":"git","status":"affected"},{"version":"4f6ccc74a85cbb4cdd373c374dc76398dc7603a1","lessThan":"9ac6db531abe98adfd395fea25c00fee37de8154","versionType":"git","status":"affected"},{"version":"4f6ccc74a85cbb4cdd373c374dc76398dc7603a1","lessThan":"59e0a04d95e160547065ab3704bd809ddf3f0e1e","versionType":"git","status":"affected"},{"version":"4f6ccc74a85cbb4cdd373c374dc76398dc7603a1","lessThan":"cbd3dafc2003db679ccd2f6c6a2551db79657049","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/i915/i915_query.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.5","status":"affected"},{"version":"0","lessThan":"5.5","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/362c42720259f42abbbafa99a12cd14f74254b7c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3726824aa1418594a7458721f8b8cafd5393a300","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59e0a04d95e160547065ab3704bd809ddf3f0e1e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9ac6db531abe98adfd395fea25c00fee37de8154","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0c727809229119598b50aba2776d236fbaa7989","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cbd3dafc2003db679ccd2f6c6a2551db79657049","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d004303557924077a327d71c80f5863b1b9ff1d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d60532306397233fb860860e9694f4e35abc0e80","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97900","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:16.787","lastModified":"2026-10-19T10:17:40.170","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/drm_exec: fix up contended obj when num_objects is 0\n\ndrm_exec_prepare_array() silently returns success without calling\ndrm_exec_lock_contended() when num_objects is zero. This breaks the\ninvariant upheld by drm_exec_lock_obj(), where every entry point into\nthe locking sequence must first attempt to lock any previously\ncontended object before proceeding.\n\nDrivers that chain multiple drm_exec_prepare_array() calls per\ndrm_exec_until_all_locked() iteration (e.g. amdgpu's userq signal/wait\nioctls, which prepare separate read and write BO arrays) can pass an\nempty array for one of the two calls. If contention is hit while\npreparing the non-empty array, exec->contended is set and the loop\nretries; on retry, the empty-array call preceding it is a no-op that\nnever clears exec->contended, so drm_exec_retry_on_contention()\nimmediately jumps back to the top of the loop without ever reaching\nthe call that would resolve the contention. This spins forever.\n\nFix it by having drm_exec_prepare_array() call drm_exec_lock_contended()\ndirectly when num_objects is zero, so a pending contended object dont\nloop infinitely."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/drm_exec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"09593216bff15866f95c8ad406cb7fdcec1ee40a","lessThan":"506cfed91e50cc8055799480a2fde5a18f63a21c","versionType":"git","status":"affected"},{"version":"09593216bff15866f95c8ad406cb7fdcec1ee40a","lessThan":"831cd124ce99c3e61266bed30519d52f7c26abed","versionType":"git","status":"affected"},{"version":"09593216bff15866f95c8ad406cb7fdcec1ee40a","lessThan":"f3e74866018dab793ebee1fdf0ef34f7271d1f8c","versionType":"git","status":"affected"},{"version":"09593216bff15866f95c8ad406cb7fdcec1ee40a","lessThan":"a565022c02f218ec9789c2baf4690792e7a48cbb","versionType":"git","status":"affected"},{"version":"09593216bff15866f95c8ad406cb7fdcec1ee40a","lessThan":"159720704d9d652b64390c11fb971e15b0a78d23","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/drm_exec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/159720704d9d652b64390c11fb971e15b0a78d23","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/506cfed91e50cc8055799480a2fde5a18f63a21c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/831cd124ce99c3e61266bed30519d52f7c26abed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a565022c02f218ec9789c2baf4690792e7a48cbb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f3e74866018dab793ebee1fdf0ef34f7271d1f8c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97901","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:16.897","lastModified":"2026-10-21T13:21:15.327","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngenetlink: pin family module during policy dump\n\nThe generic netlink controller's policy dump keeps pointers to the target\nfamily's operation and policy tables in its callback state.  A dump may be\nsplit across multiple skbs and remain pending after the initial request.\n\nNetlink pins the module which owns the dump callback, but in this case\nthat is the controller's owner rather than the target family's owner.  The\ntarget family can consequently be unregistered and its module unloaded\nwhile a policy dump is pending.  Advancing the dump then dereferences\npolicy memory from the unloaded module.\n\nTake a reference to the target family's module when the dump starts.\nDrop it from the error and done paths.  This matches the lifetime for which\nthe dump context retains the family and policy pointers."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netlink/genetlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d07dcf9aadd6b2842b439e8668ff7ea2873f28d7","lessThan":"1a345d95e59a99e25404138b5a1ec2edcb03269f","versionType":"git","status":"affected"},{"version":"d07dcf9aadd6b2842b439e8668ff7ea2873f28d7","lessThan":"6e4d746e55c83c240cffce92356763d16b236af5","versionType":"git","status":"affected"},{"version":"d07dcf9aadd6b2842b439e8668ff7ea2873f28d7","lessThan":"508387ad95ef9c13aa6431678c39763e882da2dc","versionType":"git","status":"affected"},{"version":"d07dcf9aadd6b2842b439e8668ff7ea2873f28d7","lessThan":"6d8e653fcf1c90310797eeba8e5fafe9ccc3de9e","versionType":"git","status":"affected"},{"version":"d07dcf9aadd6b2842b439e8668ff7ea2873f28d7","lessThan":"6a1094c34d176827b2b173e163dcc964a13af93f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netlink/genetlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1a345d95e59a99e25404138b5a1ec2edcb03269f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/508387ad95ef9c13aa6431678c39763e882da2dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6a1094c34d176827b2b173e163dcc964a13af93f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d8e653fcf1c90310797eeba8e5fafe9ccc3de9e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e4d746e55c83c240cffce92356763d16b236af5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97902","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:17.000","lastModified":"2026-10-19T10:17:40.403","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs: don't return -EINVAL for successful nested thaw\n\nCommit 7366f8b6fc6a (\"fs: handle freezing from multiple devices\")\nreplaced the freeze_holders bitmask with per-holder counters to allow\nnested freezes. In the bitmask version, a thaw that released a shared\nhold while another holder remained returned 0. Since the rework,\nthaw_super_locked() drops the freeze reference via freeze_dec() but\nthen returns -EINVAL when other freezers remain, misinforming the\ncaller: the thaw did succeed, the superblock just stays frozen for the\nremaining holders.\n\nThis breaks bdev-initiated freezing. When a filesystem is frozen with\nFIFREEZE and additionally frozen via bdev_freeze() -- which nests by\ndesign, see fs_bdev_freeze() -- the subsequent bdev_thaw() receives\n-EINVAL from the holder op although its freeze reference was dropped,\nand therefore keeps bd_fsfreeze_count elevated. Then device-mapper's\nunlock_fs() ignores bdev_thaw()'s return value, so nothing rebalances\nthe count. After the user's FITHAW and umount, the block device can\nnever be mounted again:\n\n    dm-1: Can't mount, blockdev is frozen\n\nThere is no way for userspace to drop the leaked count; only\ndestroying the block device (or a reboot) recovers the device.\n\nReproducer (any kernel since v6.8):\n\n    dmsetup create dut --table \"0 $(blockdev --getsz \"$DEV\") linear $DEV 0\"\n    mkfs.ext4 /dev/mapper/dut\n    mount /dev/mapper/dut /mnt\n    fsfreeze --freeze /mnt      # freeze_ucount == 1\n    dmsetup suspend dut         # bd_fsfreeze_count == 1, ucount == 2\n    dmsetup resume dut          # ucount 2 -> 1, but thaw_super()\n                                # returns -EINVAL, so bdev_thaw()\n                                # keeps bd_fsfreeze_count at 1\n    fsfreeze --unfreeze /mnt    # filesystem thaws fine\n    umount /mnt\n    mount /dev/mapper/dut /mnt  # EBUSY, forever\n\nThe same happens with fsfreeze held across an LVM snapshot of the\norigin volume.\n\nfs_bdev_thaw()'s documentation already describes the intended\nsemantics: \"If this function returns zero it doesn't mean that the\nfilesystem is unfrozen as it may have been frozen multiple times\".\nRestore them by returning 0 when a nested thaw drops its hold while\nother freezers remain. Thawing without holding a freeze still fails\nwith -EINVAL as may_unfreeze() rejects that case before the reference\ncount is touched."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7366f8b6fc6aa21c4199cb5d337b023df69745b0","lessThan":"111339816138f042a59778322f941edc26903484","versionType":"git","status":"affected"},{"version":"7366f8b6fc6aa21c4199cb5d337b023df69745b0","lessThan":"76e478499913dc1f368aebe85b28b7d1265985ff","versionType":"git","status":"affected"},{"version":"7366f8b6fc6aa21c4199cb5d337b023df69745b0","lessThan":"ff2a694f6613d54ebd77ba72583d4d94446f55bd","versionType":"git","status":"affected"},{"version":"7366f8b6fc6aa21c4199cb5d337b023df69745b0","lessThan":"fe967191e5851ea79818c5fe4e781c3882139218","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/111339816138f042a59778322f941edc26903484","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/76e478499913dc1f368aebe85b28b7d1265985ff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe967191e5851ea79818c5fe4e781c3882139218","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff2a694f6613d54ebd77ba72583d4d94446f55bd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97903","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:17.150","lastModified":"2026-10-19T10:17:40.527","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nexit: hold a reference to thread_pid across proc_flush_pid\n\nCommit 0a36bad01731 (\"release_task: kill the no longer needed\nget/put_pid(thread_pid)\") removed the reference around proc_flush_pid().\nIt assumed that free_pids(post.pids) at the end of release_task() would\nkeep thread_pid alive until then.\n\nThat assumption is wrong.  __change_pid() only records a detached PID in\npost.pids when pid_has_task() is false for every PIDTYPE.  If another task\nstill uses the exiting task's PID as its process group or session ID,\n__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves\nthe PID out of post.pids.  release_task() therefore holds no reference to\nit after dropping tasklist_lock.\n\nThe other task can then remove the remaining PIDTYPE links.  Its\nfree_pids() call schedules delayed_put_pid(), and the RCU callback can free\nthe PID before the first release_task() reaches proc_flush_pid().\n\nAn unprivileged reproducer races wait4(-1) against setsid() to trigger this\nordering.  Three of three fresh v7.2 KASAN boots reported:\n\n    BUG: KASAN: slab-use-after-free in\n    proc_invalidate_siblings_dcache+0x3e2/0x3f0\n    Read of size 8 by task h7_pid_reaper/1921\n\n    Call Trace:\n     proc_invalidate_siblings_dcache\n     release_task\n     wait_consider_task\n     __do_wait\n     do_wait\n     kernel_wait4\n\n    Freed by task 0:\n     kmem_cache_free\n     put_pid\n     delayed_put_pid\n     rcu_core\n\n    Last potentially related work creation:\n     __call_rcu_common\n     free_pids\n     ksys_setsid\n\nKASAN identified a 144-byte object from the pid cache and located the bad\nread 80 bytes into the freed object, matching pid->inodes.  With an\nexplicit reference, three of three fresh boots completed without a KASAN\nreport.  The concurrent RCU callback dropped its reference while\nproc_flush_pid() was protected, and the balancing put_pid() performed the\nfinal free afterward.\n\nTake a reference before __unhash_process() clears p->thread_pid and release\nit after proc_flush_pid() completes.\n\nA tested source reproducer is available privately on request.  No\ncontrolled read or write, information leak, or privilege escalation is\nclaimed.  The mainline patch applies directly to v6.19.y and newer;\nv6.16.y through v6.18.y need a context-adjusted backport."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/exit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0a36bad01731e71568bdd365764d38b6bd576ab0","lessThan":"bcb0936862f2b653114d9bd582ca26990ef54a64","versionType":"git","status":"affected"},{"version":"0a36bad01731e71568bdd365764d38b6bd576ab0","lessThan":"96803a12e8ac15f0a1b4b151db59038f12304e58","versionType":"git","status":"affected"},{"version":"0a36bad01731e71568bdd365764d38b6bd576ab0","lessThan":"cdd812d0683dee14ead02c9eded568685e61b23f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/exit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/96803a12e8ac15f0a1b4b151db59038f12304e58","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bcb0936862f2b653114d9bd582ca26990ef54a64","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cdd812d0683dee14ead02c9eded568685e61b23f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97904","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:17.293","lastModified":"2026-10-19T10:17:40.750","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: initialize policy rwsem before sysfs publication\n\ncpufreq_policy_alloc() initializes policy->rwsem after\nkobject_init_and_add() has created the policy sysfs directory and its\ndefault attributes. A sysfs access can therefore reach a policy callback\nbefore the semaphore has been initialized.\n\nInitialize policy->rwsem before publishing the policy kobject so sysfs\ncallbacks always see an initialized semaphore."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/cpufreq/cpufreq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"c9d8435814f2ac533c40fe3f35d94235bc3a9443","versionType":"git","status":"affected"},{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"82a54923700da5de83ce2b26c0b43f6b5005c8f1","versionType":"git","status":"affected"},{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"b14987a0f73777644099f47f01aba3b0f9dc6c27","versionType":"git","status":"affected"},{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"b22193eea2ce32c39dda5e09f9c2be2f3fd7eb4a","versionType":"git","status":"affected"},{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"dc11263cb05ed519758fd135fe08d611bad1f241","versionType":"git","status":"affected"},{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"27c9b491bf7604e83b50c3bbfa18a30266ff345f","versionType":"git","status":"affected"},{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"2cee937f779f69b195b37bbec1e888da9bfe9d58","versionType":"git","status":"affected"},{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"3e5d1bf4bd687beb2cb4e32a07af695455925588","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/cpufreq/cpufreq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/27c9b491bf7604e83b50c3bbfa18a30266ff345f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2cee937f779f69b195b37bbec1e888da9bfe9d58","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3e5d1bf4bd687beb2cb4e32a07af695455925588","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/82a54923700da5de83ce2b26c0b43f6b5005c8f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b14987a0f73777644099f47f01aba3b0f9dc6c27","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b22193eea2ce32c39dda5e09f9c2be2f3fd7eb4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9d8435814f2ac533c40fe3f35d94235bc3a9443","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc11263cb05ed519758fd135fe08d611bad1f241","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97905","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:17.403","lastModified":"2026-10-19T10:17:40.887","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: zero-initialize policy cpumask before sysfs publication\n\ncpufreq_policy_alloc() allocates policy->cpus with alloc_cpumask_var(),\ni.e. without __GFP_ZERO, unlike the sibling related_cpus and real_cpus\nmasks. With CONFIG_CPUMASK_OFFSTACK=y the mask is a separate\nkmalloc_node() allocation, so its bitmap holds whatever the slab allocator\nleft behind:\n\n  cpufreq_online()\n    cpufreq_policy_alloc()\n      alloc_cpumask_var(&policy->cpus)    /* bitmap is uninitialized */\n      kobject_init_and_add()              /* policy%u/ appears in sysfs */\n    cpufreq_policy_online()\n      cpumask_copy(policy->cpus, cpumask_of(cpu))  /* first valid value */\n\nThis leaves a window in which the sysfs attributes are already reachable\nwhile policy->cpus is still garbage. show()/store() gate on\npolicy_is_inactive(), i.e. cpumask_empty(policy->cpus), so a non-zero\nbitmap makes them run the attribute callbacks on a policy that is not\ninitialized yet.\n\nFix this by using zalloc_cpumask_var() for policy->cpus."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/cpufreq/cpufreq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"e13370c5b549712f49f80234df249303381c53b4","versionType":"git","status":"affected"},{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"e807920031ca32b668f9e7a1efbd21858f03d64b","versionType":"git","status":"affected"},{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"ca52482508b3ac9febe74ca4f732647d394727b8","versionType":"git","status":"affected"},{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"06f273d29e5e0fe5c775a65c563fbeed8cd94c7a","versionType":"git","status":"affected"},{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"0de2f3918fbbbb767e7e716178194b66560dd12a","versionType":"git","status":"affected"},{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"6e166b9281dec98aed19213a84235250e5fdb081","versionType":"git","status":"affected"},{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"bbc0472d2270bf732142ca71579d6ede636174ed","versionType":"git","status":"affected"},{"version":"2fc3384dc75bf7333384c7a16d12c796f61c3f56","lessThan":"54d37bcf2f497140b9207968557ddb484058e749","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/cpufreq/cpufreq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/06f273d29e5e0fe5c775a65c563fbeed8cd94c7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0de2f3918fbbbb767e7e716178194b66560dd12a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/54d37bcf2f497140b9207968557ddb484058e749","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e166b9281dec98aed19213a84235250e5fdb081","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bbc0472d2270bf732142ca71579d6ede636174ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ca52482508b3ac9febe74ca4f732647d394727b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e13370c5b549712f49f80234df249303381c53b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e807920031ca32b668f9e7a1efbd21858f03d64b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97906","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:17.517","lastModified":"2026-10-21T13:21:15.433","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbootconfig: Fix integer overflow in initrd size check\n\nSashiko reported that in get_boot_config_from_initrd(), a crafted initrd\nwith a huge bootconfig size (such as 0xFFFFFFFF) can cause the pointer\narithmetic:\n\n    data = ((void *)hdr) - size;\n\nto wrap around on 32-bit systems (or when pointer subtraction overflows).\nBecause data wraps around, the subsequent bounds check:\n\n    if ((unsigned long)data < initrd_start)\n\nevaluates to false, bypassing the check. The kernel then calls\nxbc_calc_checksum(data, size), which attempts to read 4GB of memory,\nhitting unmapped pages and triggering a fatal kernel page fault during\nearly boot. Furthermore, on 64-bit systems with an initrd > 4.29 GB, an\nunbounded 32-bit size can similarly bypass the initrd_start check.\n\nFix this by:\n1. Ensuring the initrd is at least large enough to contain the bootconfig\n   footer and verifying hdr is within the initrd bounds.\n2. Checking that size does not exceed XBC_DATA_MAX and does not exceed\n   the available space between initrd_start and hdr before performing\n   pointer subtraction."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["init/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"de462e5f10718517bacf2f84c8aa2804567ef7df","lessThan":"97be05f33f79342ea65d9b99c9ad07a93b8eef5a","versionType":"git","status":"affected"},{"version":"de462e5f10718517bacf2f84c8aa2804567ef7df","lessThan":"4d45bc0f8cdf606d5409b5f64a8a6609f6520c03","versionType":"git","status":"affected"},{"version":"de462e5f10718517bacf2f84c8aa2804567ef7df","lessThan":"8d4343a411eaa182d323ab5b149496416015f27d","versionType":"git","status":"affected"},{"version":"de462e5f10718517bacf2f84c8aa2804567ef7df","lessThan":"bff9a1579e2c9b2a59fdf3793becc9d7bf5ff1a6","versionType":"git","status":"affected"},{"version":"de462e5f10718517bacf2f84c8aa2804567ef7df","lessThan":"7812d6dab0698001e50e8c2f901e17da3eb6f429","versionType":"git","status":"affected"},{"version":"32394df25d8e46935b442b429d74b37885c4f092","versionType":"git","status":"affected"},{"version":"5.6.14","lessThan":"5.7","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["init/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4d45bc0f8cdf606d5409b5f64a8a6609f6520c03","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7812d6dab0698001e50e8c2f901e17da3eb6f429","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8d4343a411eaa182d323ab5b149496416015f27d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97be05f33f79342ea65d9b99c9ad07a93b8eef5a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bff9a1579e2c9b2a59fdf3793becc9d7bf5ff1a6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97907","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:17.627","lastModified":"2026-10-19T10:17:41.147","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: Don't leak return code when parsing firmware format v2\n\nWhen key_id from chip is zero, rtlbt_parse_firmware_v2() intentionally\nignores all security headers. However, the implementation simply breaks\nfrom a switch statement and leaks uninitialized return code `rc' (if the\nfirst section is a security one) or the previous section's `rc'.\n\nFix it by really skipping a loop with `continue'. For consistency and\nreadability, also do the same for the default case."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/bluetooth/btrtl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa","lessThan":"ba96047bba4a6101267cf4f6b3057cbc58e6c554","versionType":"git","status":"affected"},{"version":"9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa","lessThan":"90f3a142b5f8596a565b8e080d18a8050be6edef","versionType":"git","status":"affected"},{"version":"9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa","lessThan":"422f6547259654bae690713614c794dd1e2c0a0b","versionType":"git","status":"affected"},{"version":"9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa","lessThan":"c4249cf6e80b1bd62a6a409aaabe760fe025dac3","versionType":"git","status":"affected"},{"version":"9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa","lessThan":"83e3e515fd261600ed8491fb0a8bcdfb115c904e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/bluetooth/btrtl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/422f6547259654bae690713614c794dd1e2c0a0b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83e3e515fd261600ed8491fb0a8bcdfb115c904e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/90f3a142b5f8596a565b8e080d18a8050be6edef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba96047bba4a6101267cf4f6b3057cbc58e6c554","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4249cf6e80b1bd62a6a409aaabe760fe025dac3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97908","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:17.730","lastModified":"2026-10-21T13:21:15.550","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev\n\nThe command and ACL RPMsg endpoints store struct btqcomsmd as their\ncallback private data. The receive callbacks dereference btq->hdev\nwithout taking an hci_dev reference.\n\nThe current teardown order frees the hci_dev before destroying the RPMsg\nendpoints in both the hci_register_dev() error path and the driver remove\npath. If WCNSS delivers data in that window, the endpoint callback can\nrun with an already freed hci_dev and pass it to the Bluetooth core.\n\nFor qcom_smd endpoints, rpmsg_destroy_ept() closes the channel and clears\nthe callback under the channel recv_lock. The receive path holds the same\nlock while invoking the callback, so destroying the endpoints first both\nprevents new callbacks and serializes with any callback already running.\n\nDestroy the command and ACL endpoints before hci_free_dev(). Keep\nhci_unregister_dev() first during remove so the HCI core stops issuing\noperations before the transport endpoints are shut down. In the full\nregistration-error cleanup path, return directly after freeing the hci_dev\nto avoid falling through to the partial-construction labels and destroying\nthe endpoints twice."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/bluetooth/btqcomsmd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5052de8deff5619a9b7071f00084fd0264b58e17","lessThan":"aaa7f676418e1eb2c4ef0d4e4b07812b25e7b404","versionType":"git","status":"affected"},{"version":"5052de8deff5619a9b7071f00084fd0264b58e17","lessThan":"962dcc1d8a52e64428cae07806e7f6b8d3ec6ac0","versionType":"git","status":"affected"},{"version":"5052de8deff5619a9b7071f00084fd0264b58e17","lessThan":"2dcc2240b4e5f6e5dce1736f82666aba40eb3b13","versionType":"git","status":"affected"},{"version":"5052de8deff5619a9b7071f00084fd0264b58e17","lessThan":"2d016208a011558f211ec9687889df8318654730","versionType":"git","status":"affected"},{"version":"5052de8deff5619a9b7071f00084fd0264b58e17","lessThan":"f5a427b16e45210dee656b0860728f3d496dee85","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/bluetooth/btqcomsmd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2d016208a011558f211ec9687889df8318654730","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2dcc2240b4e5f6e5dce1736f82666aba40eb3b13","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/962dcc1d8a52e64428cae07806e7f6b8d3ec6ac0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aaa7f676418e1eb2c4ef0d4e4b07812b25e7b404","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5a427b16e45210dee656b0860728f3d496dee85","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97909","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:17.847","lastModified":"2026-10-19T10:17:41.383","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: sti: initialize IRQ lock before requesting IRQ\n\nuni_reader_init() registers the shared IRQ before initializing\nreader->irq_lock. A pending interrupt can invoke the handler while the\nlock is still uninitialized.\n\nInitialize the lock before registering the IRQ so the interrupt path\nalways sees valid lock state."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/soc/sti/uniperif_reader.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d05d862ead8eca5e7d4ccf82d39d9189579ee5b1","lessThan":"9128265f0fc8031a71775d70786052e5631aac54","versionType":"git","status":"affected"},{"version":"d05d862ead8eca5e7d4ccf82d39d9189579ee5b1","lessThan":"181bb64a1333bbf3c369123d05614536f3ae7b7c","versionType":"git","status":"affected"},{"version":"d05d862ead8eca5e7d4ccf82d39d9189579ee5b1","lessThan":"3a9552d18fc8174bab015bc941ede19452b184b3","versionType":"git","status":"affected"},{"version":"d05d862ead8eca5e7d4ccf82d39d9189579ee5b1","lessThan":"45021eb56211431f0ef44001b7d12cce32d49261","versionType":"git","status":"affected"},{"version":"d05d862ead8eca5e7d4ccf82d39d9189579ee5b1","lessThan":"f1e7b74512164314d0550ec5b62e3d40b95b0986","versionType":"git","status":"affected"},{"version":"d05d862ead8eca5e7d4ccf82d39d9189579ee5b1","lessThan":"998ca92f69bc43499705016d02ffaf0663126d57","versionType":"git","status":"affected"},{"version":"d05d862ead8eca5e7d4ccf82d39d9189579ee5b1","lessThan":"a42dd4dae4c9191caa017cf54cc40b6bb125be65","versionType":"git","status":"affected"},{"version":"d05d862ead8eca5e7d4ccf82d39d9189579ee5b1","lessThan":"04405aeef4f8d7bcac6dcb1947acafdb4420c2c3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/soc/sti/uniperif_reader.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.11","status":"affected"},{"version":"0","lessThan":"4.11","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/04405aeef4f8d7bcac6dcb1947acafdb4420c2c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/181bb64a1333bbf3c369123d05614536f3ae7b7c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3a9552d18fc8174bab015bc941ede19452b184b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/45021eb56211431f0ef44001b7d12cce32d49261","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9128265f0fc8031a71775d70786052e5631aac54","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/998ca92f69bc43499705016d02ffaf0663126d57","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a42dd4dae4c9191caa017cf54cc40b6bb125be65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1e7b74512164314d0550ec5b62e3d40b95b0986","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97910","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:17.957","lastModified":"2026-10-19T10:17:41.513","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: sprd: validate compress buffer sizes against fixed allocations\n\nsprd_platform_compr_open() allocates the stage 0 IRAM buffer (32K data\narea) and the stage 1 DDR buffer (2M data area) with fixed sizes, but\nsprd_platform_compr_copy() derives all copy lengths from the user\ncontrolled runtime->fragment_size and the write() count, never\ncomparing them against the physical buffer sizes. The compress core\nonly checks fragment_size * fragments for an u32 overflow in\nsnd_compress_check_input(), so a local user can configure a logical\nbuffer of up to ~4GB via SNDRV_COMPRESS_SET_PARAMS, far exceeding the\nfixed allocations.\n\nA fragment_size larger than the 32K IRAM data area makes the stage 0\ncopy_from_user() overflow past the IRAM allocation, and a buffer_size\nlarger than the 2M DDR buffer makes the wrapping copy at the end of\nsprd_platform_compr_copy() write fully user controlled data past the\nbuffer. No SNDRV_PCM_TRIGGER_START is needed, a write() in SETUP\nstate reaches the copy callback directly.\n\nReject parameters that do not fit into the fixed buffers in\nset_params(), and fix the advertised max fragment size: 128K never\nfitted into the 32K IRAM buffer. The caps values may have been carried over\nfrom the qdsp6 driver, which allocates its buffers according to the\nadvertised maxima, unlike this driver. With 32K as max fragment size\nthe advertised limits are self-consistent: 32K * 64 = 2M equals the\nDDR buffer size.\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/soc/sprd/sprd-pcm-compress.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cce1396936ef2b347d622b4d49718818eb32029d","lessThan":"2fada8276117215407afd1f59de5d2fe22aff01f","versionType":"git","status":"affected"},{"version":"cce1396936ef2b347d622b4d49718818eb32029d","lessThan":"ad796a1bc1875da2ebb616ea9bc1f2994273fd02","versionType":"git","status":"affected"},{"version":"cce1396936ef2b347d622b4d49718818eb32029d","lessThan":"2e27144ba4b98bb3eb14aaccd4b088e2e69844e3","versionType":"git","status":"affected"},{"version":"cce1396936ef2b347d622b4d49718818eb32029d","lessThan":"1467e3989c6edf79d3898c78aa47027f31ee5acb","versionType":"git","status":"affected"},{"version":"cce1396936ef2b347d622b4d49718818eb32029d","lessThan":"38a9bb5221bcdece5507299f739c6751d8fc16b2","versionType":"git","status":"affected"},{"version":"cce1396936ef2b347d622b4d49718818eb32029d","lessThan":"ff63b0adc4f6a5b61c8393d204fac44c594c4d39","versionType":"git","status":"affected"},{"version":"cce1396936ef2b347d622b4d49718818eb32029d","lessThan":"8064b73997f137c00a7e2e38295a763f9423928b","versionType":"git","status":"affected"},{"version":"cce1396936ef2b347d622b4d49718818eb32029d","lessThan":"7a4ce92d150b9e7ecf1a710a34d8cdeb590d3751","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/soc/sprd/sprd-pcm-compress.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.2","status":"affected"},{"version":"0","lessThan":"5.2","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1467e3989c6edf79d3898c78aa47027f31ee5acb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2e27144ba4b98bb3eb14aaccd4b088e2e69844e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2fada8276117215407afd1f59de5d2fe22aff01f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38a9bb5221bcdece5507299f739c6751d8fc16b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a4ce92d150b9e7ecf1a710a34d8cdeb590d3751","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8064b73997f137c00a7e2e38295a763f9423928b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad796a1bc1875da2ebb616ea9bc1f2994273fd02","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff63b0adc4f6a5b61c8393d204fac44c594c4d39","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97911","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:18.070","lastModified":"2026-10-19T10:17:41.680","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel: ethosu: Ensure SRAM region size matches job\n\nIt is possible for userspace to set the job SRAM size to 0, but then still\nhave SRAM accesses in the command stream. When the job SRAM size is 0,\nsetting the region base register is skipped and a stale base address from\na prior job is used.\n\nCheck the region size against the job's SRAM size instead of just the size\nof the SRAM. The job's SRAM size was already checked against the total SRAM\nsize."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/accel/ethosu/ethosu_job.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9cff90774872ed6613b7571ce018b5b455d86890","lessThan":"50c27d412fedc95b8d54d477af47451a382e8cdd","versionType":"git","status":"affected"},{"version":"9cff90774872ed6613b7571ce018b5b455d86890","lessThan":"2b39d680c9e0fb4d625f2916980977622e84248c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/accel/ethosu/ethosu_job.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2b39d680c9e0fb4d625f2916980977622e84248c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/50c27d412fedc95b8d54d477af47451a382e8cdd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97912","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:18.173","lastModified":"2026-10-19T10:17:41.803","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel: ethosu: Ensure SRAM size is 0 on mapping failure\n\nOn a mapping failure of the SRAM, the SRAM size is left as non-zero. The\nprobe will succeed as the error return is not checked since having SRAM is\nnot a hard requirement. The non-zero size allows jobs to access SRAM which\nis left pointing to physical base address 0x0."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/accel/ethosu/ethosu_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b","lessThan":"e5576641b79ecd36acaf91fec4a5333b1ad19c57","versionType":"git","status":"affected"},{"version":"5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b","lessThan":"f5376d7e0fb703876199d3b6f9f97e128fa2f8a4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/accel/ethosu/ethosu_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/e5576641b79ecd36acaf91fec4a5333b1ad19c57","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5376d7e0fb703876199d3b6f9f97e128fa2f8a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97913","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:18.280","lastModified":"2026-10-19T10:17:41.900","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel: ethosu: Ensure cmd stream ends with a stop op\n\nWhile the QSIZE register setting should prevent an out of bounds access\nof the command stream, it is not clear whether the h/w generates an\ninterrupt in this case as is required (to prevent a timeout). As a stop op\nis expected end of the command stream, let's just ensure it is present. A\nstop op in the middle of the command stream also makes no sense."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/accel/ethosu/ethosu_device.h","drivers/accel/ethosu/ethosu_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b","lessThan":"bf957f166f7ba548034db2a10e63f71df97f12e2","versionType":"git","status":"affected"},{"version":"5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b","lessThan":"eb3a41fd35e352fba387c4320a1fa0352f3e551c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/accel/ethosu/ethosu_device.h","drivers/accel/ethosu/ethosu_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/bf957f166f7ba548034db2a10e63f71df97f12e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb3a41fd35e352fba387c4320a1fa0352f3e551c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97914","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:18.383","lastModified":"2026-10-19T10:17:42.007","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel: ethosu: Fix ethosu_job_open() return value\n\nA WARN_ON() returns a 0 or 1, not the original negative errno. Just drop\nthe WARN_ON() as the FD open will pass the return code to userspace and\nthere's only one possible source of the error (drm_sched_entity_init())."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/accel/ethosu/ethosu_job.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b","lessThan":"e98afe5142add34b70b305408317a325f14c37f5","versionType":"git","status":"affected"},{"version":"5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b","lessThan":"b3c8d4672f7a8735e2884cefcd89286268e88b2e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/accel/ethosu/ethosu_job.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/b3c8d4672f7a8735e2884cefcd89286268e88b2e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e98afe5142add34b70b305408317a325f14c37f5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97915","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:18.487","lastModified":"2026-10-21T13:21:15.673","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Limit firmware log name prints to field size\n\nThe name in struct vpu_tracing_buffer_header is a fixed-size array\npopulated by the NPU firmware. It is expected to be NUL-terminated,\nbut nothing on the host side enforces this, so printing it with an\nunbounded string conversion would read past the field if the\nterminator is ever missing and expose adjacent bytes of the shared\ntracing BO through dmesg and the debugfs FW log output.\n\nPrint at most as many characters as the name field holds, so the output\nnever runs past it even if the string is not NUL-terminated."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/accel/ivpu/ivpu_fw_log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d4e4257afa6ed5205eda993180401fc2c20e4b60","lessThan":"3d9365093f16b069908e610d17da172bf006bbde","versionType":"git","status":"affected"},{"version":"d4e4257afa6ed5205eda993180401fc2c20e4b60","lessThan":"6dbba89df4e842d226f5cd3dbc5e94533cfceea2","versionType":"git","status":"affected"},{"version":"d4e4257afa6ed5205eda993180401fc2c20e4b60","lessThan":"5d06257359c9006a208fece9eb7f0a0e83e0cc92","versionType":"git","status":"affected"},{"version":"d4e4257afa6ed5205eda993180401fc2c20e4b60","lessThan":"3d7130807009e9be6132c1394a2c7708a3ba39a7","versionType":"git","status":"affected"},{"version":"d4e4257afa6ed5205eda993180401fc2c20e4b60","lessThan":"95bf070f3225dc7175725438c916ad321d42fe45","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/accel/ivpu/ivpu_fw_log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3d7130807009e9be6132c1394a2c7708a3ba39a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3d9365093f16b069908e610d17da172bf006bbde","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d06257359c9006a208fece9eb7f0a0e83e0cc92","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6dbba89df4e842d226f5cd3dbc5e94533cfceea2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/95bf070f3225dc7175725438c916ad321d42fe45","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97916","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:18.593","lastModified":"2026-10-21T13:21:15.810","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Validate firmware log buffer metadata\n\nThe tracing log headers parsed by fw_log_print_buffer() reside in\nDMA-shared BOs that the NPU firmware can write to.\n\nfw_log_from_bo() validated log->header_size and log->size, but\nfw_log_print_buffer() re-read those same fields from shared memory\nafterwards, allowing a TOCTOU where firmware changes them between the\ncheck and the use, and making the host dereference out-of-bounds\naddresses while printing logs.\n\nSnapshot the validated values once with READ_ONCE() and pass them down\nexplicitly in a new struct ivpu_fw_log_desc instead of re-reading them\nfrom the shared struct."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/accel/ivpu/ivpu_fw_log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d4e4257afa6ed5205eda993180401fc2c20e4b60","lessThan":"07d4190d75021c38b7994045179aa29131634d4f","versionType":"git","status":"affected"},{"version":"d4e4257afa6ed5205eda993180401fc2c20e4b60","lessThan":"8ec3d6972f1440fae6c8dadd1859892775208759","versionType":"git","status":"affected"},{"version":"d4e4257afa6ed5205eda993180401fc2c20e4b60","lessThan":"40868f80a89199630b03d4457876f9a1feba0660","versionType":"git","status":"affected"},{"version":"d4e4257afa6ed5205eda993180401fc2c20e4b60","lessThan":"b1555f63ee1a680f280bc18e8dac416f250e2ec3","versionType":"git","status":"affected"},{"version":"d4e4257afa6ed5205eda993180401fc2c20e4b60","lessThan":"0724afc55c77c36c7feb9a7264b02aa7593c5c2d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/accel/ivpu/ivpu_fw_log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0724afc55c77c36c7feb9a7264b02aa7593c5c2d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/07d4190d75021c38b7994045179aa29131634d4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/40868f80a89199630b03d4457876f9a1feba0660","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8ec3d6972f1440fae6c8dadd1859892775208759","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1555f63ee1a680f280bc18e8dac416f250e2ec3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97917","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:18.700","lastModified":"2026-10-21T13:21:15.943","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Validate full buffer range in ivpu_to_cpu_addr\n\nAdd a size parameter to ivpu_to_cpu_addr() and validate that the\nwhole [vpu_addr, vpu_addr + size) range stays within the BO."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/accel/ivpu/ivpu_gem.h","drivers/accel/ivpu/ivpu_ipc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"647371a6609ddf8700fe151af72e32daebb9baa7","lessThan":"962e565f45dbea77d12a7ed5ef34df8f0c603e28","versionType":"git","status":"affected"},{"version":"647371a6609ddf8700fe151af72e32daebb9baa7","lessThan":"5419be345f32222750e006b85b7f9bae1a285c8e","versionType":"git","status":"affected"},{"version":"647371a6609ddf8700fe151af72e32daebb9baa7","lessThan":"43c68f52aecd519eb682fa09d57ae52c896f860f","versionType":"git","status":"affected"},{"version":"647371a6609ddf8700fe151af72e32daebb9baa7","lessThan":"29f82a2280e170429370e7a842cde4e70ead8547","versionType":"git","status":"affected"},{"version":"647371a6609ddf8700fe151af72e32daebb9baa7","lessThan":"3837c3f29fbc3b8c12bebf5c62741e2befe3482a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/accel/ivpu/ivpu_gem.h","drivers/accel/ivpu/ivpu_ipc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/29f82a2280e170429370e7a842cde4e70ead8547","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3837c3f29fbc3b8c12bebf5c62741e2befe3482a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/43c68f52aecd519eb682fa09d57ae52c896f860f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5419be345f32222750e006b85b7f9bae1a285c8e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/962e565f45dbea77d12a7ed5ef34df8f0c603e28","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97918","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:18.807","lastModified":"2026-10-21T13:21:16.053","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Undo the registration when enabling the histogram trigger fails\n\nCommit 6f86bdeab633 (\"tracing: Fix bad hist from corrupting named_triggers\nlist\") described how a trigger that is registered but not on file->triggers\nends up freed while still on the global named_triggers list, and moved the\nregistration down so that hist_trigger_enable() follows it immediately. One\npath still gets there. hist_trigger_enable() adds the trigger and takes it\nstraight back out when the event cannot be enabled:\n\n\tlist_add_tail_rcu(&data->list, &file->triggers);\n\n\tupdate_cond_flag(file);\n\n\tif (trace_event_trigger_enable_disable(file, 1) < 0) {\n\t\tlist_del_rcu(&data->list);\n\t\tupdate_cond_flag(file);\n\t\tret--;\n\t}\n\nso the list walk in hist_unregister_trigger() matches nothing, test stays\nNULL, and the ->free() that would call del_named_trigger() is skipped.\nout_unreg falls through to out_free, which frees the trigger anyway:\n\n BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0\n Read of size 8 at addr ffff8880091d3160 by task init/1\n  find_named_trigger+0xac/0xc0\n  hist_register_trigger+0xc1/0xa00\n  event_hist_trigger_parse+0x3146/0x6af0\n  event_trigger_write+0xce/0x160\n Freed by task 69:\n  kfree+0x154/0x420\n  trigger_kthread_fn+0xfd/0x160\n\nLeave the trigger where hist_unregister_trigger() can find it and let that\nundo the registration, which is the only code that knows all of what\ncmd_ops->init() took: the named list entry, the hist_pad reference, the\nreference on the trigger a named histogram is shared with, and the copied\ncmd_ops. It also pairs the failed trace_event_trigger_enable_disable(),\nwhose sm_ref and buffered event reference are otherwise left behind.\n\nSince ->free() releases trigger_data and, for a trigger that does not share\nits histogram, hist_data with it, out_unreg can no longer fall through to\nout_free. For a trigger that does share, hist_register_trigger() has\nalready destroyed the caller's hist_data, so the fall-through was reading\nfreed memory there as well.\n\nMove the enable_timestamps check in hist_unregister_trigger() above the\n->free() call for the same reason: hist_data does not outlive it once the\ntrigger being removed is the one that owns it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"067fe038e70f6e64960d26a79c4df5f1413d0f13","lessThan":"880712b6f48103ba3a04b154ff076d45fe86dcec","versionType":"git","status":"affected"},{"version":"067fe038e70f6e64960d26a79c4df5f1413d0f13","lessThan":"c7ee2d5733574d4694f7c0035e4381f54c1fca27","versionType":"git","status":"affected"},{"version":"067fe038e70f6e64960d26a79c4df5f1413d0f13","lessThan":"51b07104d563d4be2be34158d3b9d922ca417642","versionType":"git","status":"affected"},{"version":"067fe038e70f6e64960d26a79c4df5f1413d0f13","lessThan":"bfa6bc11aef93a3d9db0ac9564b734849a9d959b","versionType":"git","status":"affected"},{"version":"067fe038e70f6e64960d26a79c4df5f1413d0f13","lessThan":"92383cef66791a0c63a2f27755cadbdb2fbf270b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/51b07104d563d4be2be34158d3b9d922ca417642","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/880712b6f48103ba3a04b154ff076d45fe86dcec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/92383cef66791a0c63a2f27755cadbdb2fbf270b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfa6bc11aef93a3d9db0ac9564b734849a9d959b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c7ee2d5733574d4694f7c0035e4381f54c1fca27","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97919","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:18.923","lastModified":"2026-10-21T13:21:16.177","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Take the reference before publishing the named histogram trigger\n\nevent_hist_trigger_named_init() puts the trigger on the global\nnamed_triggers list and only then takes the reference on the trigger it\nshares its histogram with:\n\n\tdata->ref++;\n\n\tsave_named_trigger(data->named_data->name, data);\n\n\tret = event_hist_trigger_init(data->named_data);\n\tif (ret < 0) {\n\t\tkfree(data->cmd_ops);\n\t\tdata->cmd_ops = &trigger_hist_cmd;\n\t}\n\n\treturn ret;\n\nevent_hist_trigger_init() fails when alloc_hist_pad() cannot allocate, and\nnothing takes the trigger back off the list on the way out.\nevent_hist_trigger_parse() frees it, and the next lookup by name reads the\nfreed object:\n\n BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0\n Read of size 8 at addr ffff888009346860 by task init/1\n  find_named_trigger+0xac/0xc0\n  hist_register_trigger+0xc1/0xa00\n  event_hist_trigger_parse+0x3146/0x6af0\n  event_trigger_write+0xce/0x160\n Freed by task 67:\n  kfree+0x154/0x420\n  trigger_kthread_fn+0xfd/0x160\n\nDo the reference first and publish once it has succeeded, so that nothing\nwhich can fail runs after the trigger becomes findable."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ac7ab38c271ba2edaeb0dc35b200ec13339776ae","lessThan":"e5c5dad169fb569161d3eed6c3f6a59e65db1830","versionType":"git","status":"affected"},{"version":"e53a8dcd36b9ebc9229450eb594ae20e0b2ae0fd","lessThan":"b6fb2f5370a9a6aec325ab2db1ca3d1a881499b8","versionType":"git","status":"affected"},{"version":"7ab0fc61ce73040f89b12d76a8279995ec283541","lessThan":"2ffaade3611bd9501bc0b9d5d19fc75bfee7a16b","versionType":"git","status":"affected"},{"version":"7ab0fc61ce73040f89b12d76a8279995ec283541","lessThan":"91c15cdda6033e2439f5975b938754152f3d6e38","versionType":"git","status":"affected"},{"version":"7ab0fc61ce73040f89b12d76a8279995ec283541","lessThan":"0fe23b8eaba0d3372c66b7b31204408da0715edc","versionType":"git","status":"affected"},{"version":"740dab2338f70d93aa8235db5a9541d846d7b21c","versionType":"git","status":"affected"},{"version":"6.6.94","lessThan":"6.6.160","versionType":"semver","status":"affected"},{"version":"6.12.34","lessThan":"6.12.112","versionType":"semver","status":"affected"},{"version":"6.15.3","lessThan":"6.16","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0fe23b8eaba0d3372c66b7b31204408da0715edc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2ffaade3611bd9501bc0b9d5d19fc75bfee7a16b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91c15cdda6033e2439f5975b938754152f3d6e38","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6fb2f5370a9a6aec325ab2db1ca3d1a881499b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e5c5dad169fb569161d3eed6c3f6a59e65db1830","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97920","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:19.037","lastModified":"2026-10-19T10:17:42.690","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Keep the entry count when the histogram stats allocation fails\n\nprint_entries() uses n_entries both as the number of sort entries and as\nits own return value, so the -ENOMEM it stores when the stats allocation\nfails overwrites the count that the cleanup still needs:\n\n\tn_entries = tracing_map_sort_entries(map, ...);\n\tif (n_entries < 0)\n\t\treturn n_entries;\n\t...\n\t\t\tif (!stats) {\n\t\t\t\tn_entries = -ENOMEM;\n\t\t\t\tgoto out;\n\t\t\t}\n\t...\n out:\n\ttracing_map_destroy_sort_entries(sort_entries, n_entries);\n\ntracing_map_destroy_sort_entries() takes an unsigned int and loops up to\nit, so -ENOMEM arrives as 4294967284. It walks an array of at most\nmap->max_elts pointers and calls destroy_sort_entry(), which dereferences\nand frees, on whatever lies past the end.\n\nReading the hist file of a trigger with a .percent value, with that\nallocation forced to fail:\n\n  BUG: KASAN: vmalloc-out-of-bounds in tracing_map_destroy_sort_entries+0xa0/0xb0\n  Read of size 8 at addr ffffc90000045000 by task init/1\n   tracing_map_destroy_sort_entries+0xa0/0xb0\n   hist_show+0x6f7/0x1df0\n   seq_read_iter+0x2b8/0x1190\n   vfs_read+0x176/0xa40\n  The buggy address belongs to a 4-page vmalloc region starting at\n  ffffc90000041000 allocated at tracing_map_sort_entries+0x5c/0xd50\n\nA few pages further the fault is fatal. The registers at the oops confirm\nthe bound: the loop's end pointer less the array start, over the pointer\nsize, is 4294967284.\n\nReturn the error in a separate variable and leave n_entries holding the\ncount, the way tracing_map_sort_entries() does on its own error path.\n\nThe stats block is only entered for a value carrying .percent or .graph,\nwhich __create_val_field() has rejected since v6.3, so this cannot be\nreached in mainline as it stands. It becomes reachable again with\n\"tracing: hist: let values keep the percent and graph modifiers\", so it\nshould be applied first."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"93454d1a306ea975294b861d32ffa1e44b20c733","lessThan":"89c978d67ad01ce28223944cc58e95feea177b35","versionType":"git","status":"affected"},{"version":"abaa5258ce5e5887a9de049f50a85dc023391a1c","lessThan":"fe05eeed27128e17d38dbc0af02e4470bcecda89","versionType":"git","status":"affected"},{"version":"abaa5258ce5e5887a9de049f50a85dc023391a1c","lessThan":"9bd8321f5370295d1ae96dd17d43be3c9edd441b","versionType":"git","status":"affected"},{"version":"abaa5258ce5e5887a9de049f50a85dc023391a1c","lessThan":"c80b2a8067d58ff7d268ceef781c68b37a16c321","versionType":"git","status":"affected"},{"version":"abaa5258ce5e5887a9de049f50a85dc023391a1c","lessThan":"17e87ce55f877efff1b08fe509e8bf91378cbbc9","versionType":"git","status":"affected"},{"version":"abaa5258ce5e5887a9de049f50a85dc023391a1c","lessThan":"06f5634ec5584954177f9a22e36b3bfb398a971b","versionType":"git","status":"affected"},{"version":"6.1.23","lessThan":"6.1.189","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/06f5634ec5584954177f9a22e36b3bfb398a971b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/17e87ce55f877efff1b08fe509e8bf91378cbbc9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/89c978d67ad01ce28223944cc58e95feea177b35","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9bd8321f5370295d1ae96dd17d43be3c9edd441b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c80b2a8067d58ff7d268ceef781c68b37a16c321","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe05eeed27128e17d38dbc0af02e4470bcecda89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97921","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:19.160","lastModified":"2026-10-19T10:17:42.817","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Free histogram the field rejected for a bad modifier\n\nWriting a hist trigger whose value or variable carries a modifier that is\nnot allowed there leaks the fields that were built for it.\n\n__create_val_field() takes the field from parse_expr() and stores it in\nhist_data->fields[] only after the modifier checks have run:\n\n\thist_field = parse_expr(hist_data, file, field_str, flags, var_name,\n\t\t\t\t&n_subexprs);\n\t...\n\tif (hist_field->flags & HIST_FIELD_FL_VAR) {\n\t\tif (hist_field->flags & (...))\n\t\t\tgoto err;\n\t} else {\n\t\tif (hist_field->flags & (...))\n\t\t\tgoto err;\n\t}\n\n\thist_data->fields[val_idx] = hist_field;\n\nBoth checks jump past that store, and the err label returns without\nfreeing anything. The error unwinds to create_hist_data(), which calls\ndestroy_hist_data() -> destroy_hist_fields(), and that reaches a field\nonly by walking fields[]. A field that never got there is unreachable.\n\ncommit e0213434fe3e (\"tracing: Do not let histogram values have some\nmodifiers\") set ret to -EINVAL and fell through to the store, which left\nthe field owned by fields[] and freed along with the rest of hist_data.\nSplitting the check into a value case and a variable case replaced that\nfall-through with a goto that skips it.\n\nWith CONFIG_DEBUG_KMEMLEAK, 200 writes of\n\n  # echo 'hist:keys=prev_pid:vals=next_pid.log2' > \\\n\t events/sched/sched_switch/trigger\n\neach correctly rejected with -EINVAL, leave 332 unreferenced objects\n(63744 bytes) reported at create_hist_field(); 200 install and remove\ncycles of a valid trigger leave none. A '.log2' field is two\nallocations, since create_hist_field() puts the plain field in\noperands[0] of the log2 field, and both are reported.\n\nUse destroy_hist_field() rather than __destroy_hist_field() so that\noperands[0] is freed as well. It returns early for HIST_FIELD_FL_VAR_REF,\nwhich is what an operand owned by hist_data->var_refs[] needs; the\nrejected field itself is never a var ref, because a var ref never carries\na modifier flag."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7403630eb94c1d664fb873f967427ef2f6ee3699","lessThan":"a2652fcf96b63e9da04951e4e58e6a0672df695d","versionType":"git","status":"affected"},{"version":"e30fbc618e97b38dbb49f1d44dcd0778d3f23b8c","lessThan":"3d42fed18b2c5707b6332ebe87b789fd768eb01b","versionType":"git","status":"affected"},{"version":"e30fbc618e97b38dbb49f1d44dcd0778d3f23b8c","lessThan":"e787361bb6b0026ea3eb4d3fa7a304c7fcb99555","versionType":"git","status":"affected"},{"version":"e30fbc618e97b38dbb49f1d44dcd0778d3f23b8c","lessThan":"b22dc0add7d72b8bd9cae3188db0dd65da1c8652","versionType":"git","status":"affected"},{"version":"e30fbc618e97b38dbb49f1d44dcd0778d3f23b8c","lessThan":"891c21f6d5673b2a519b536243bfc6dd2d35beb6","versionType":"git","status":"affected"},{"version":"e30fbc618e97b38dbb49f1d44dcd0778d3f23b8c","lessThan":"230234d12ce42ab04132a32c3a848f07a5d27a71","versionType":"git","status":"affected"},{"version":"8d505d06d7330f5d67d3e5e9e1c647fb0b10ddad","versionType":"git","status":"affected"},{"version":"6.1.33","lessThan":"6.1.189","versionType":"semver","status":"affected"},{"version":"6.3.7","lessThan":"6.4","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/230234d12ce42ab04132a32c3a848f07a5d27a71","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3d42fed18b2c5707b6332ebe87b789fd768eb01b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/891c21f6d5673b2a519b536243bfc6dd2d35beb6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a2652fcf96b63e9da04951e4e58e6a0672df695d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b22dc0add7d72b8bd9cae3188db0dd65da1c8652","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e787361bb6b0026ea3eb4d3fa7a304c7fcb99555","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97922","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:19.287","lastModified":"2026-10-19T10:17:42.943","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Free histogram var refs regardless of how often they are referenced\n\nUsing the same variable three or more times in one hist trigger leaks the\nvariable reference and its strings when the trigger is removed.\n\ncommit 656fe2ba85e8 (\"tracing: Use hist trigger's var_ref array to destroy\nvar_refs\") made a trigger's var_refs[] array the only owner of a var ref:\ndestroy_hist_field() returns early for HIST_FIELD_FL_VAR_REF, so the field\nexpressions never destroy one. One entry, freed once, no count needed.\n\ncommit 8bcebc77e85f (\"tracing: Fix histogram code when expression has same\nvar as value\") then made repeated references share one object and added a\ncount of them. Only the increment side exists, since those expressions\nstill return early and never drop a reference, so __destroy_hist_field()\nsees how many references were created rather than how many are left. It\nfrees when the decremented count is 0 or 1, so two references work and\nthree or more leak.\n\nSharing kept one array entry per object, and create_var_ref() searches and\nappends within a single trigger, so nothing outside it holds the object.\nRemoving a trigger whose variables are still referenced is already refused\nby check_var_refs() with -EBUSY. Drop the count and free unconditionally."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8bcebc77e85f3d7536f96845a0fe94b1dddb6af0","lessThan":"a1f1d64a0a9791c842c4646253daf6ac0313eac7","versionType":"git","status":"affected"},{"version":"8bcebc77e85f3d7536f96845a0fe94b1dddb6af0","lessThan":"b513a4c60a7aa1f4b4c2a48544ab003cb36f1e94","versionType":"git","status":"affected"},{"version":"8bcebc77e85f3d7536f96845a0fe94b1dddb6af0","lessThan":"e7b6d67b43caee9183a4374d23641578ea556e6c","versionType":"git","status":"affected"},{"version":"8bcebc77e85f3d7536f96845a0fe94b1dddb6af0","lessThan":"4cff53bb19412c6f2d90b50678de5c3903f7f96a","versionType":"git","status":"affected"},{"version":"8bcebc77e85f3d7536f96845a0fe94b1dddb6af0","lessThan":"94bbd65da4ae26592fa1977a74ee94218ab02a26","versionType":"git","status":"affected"},{"version":"8bcebc77e85f3d7536f96845a0fe94b1dddb6af0","lessThan":"4bddcb346a6cf4615ca77f69a589623b877ca267","versionType":"git","status":"affected"},{"version":"ce28d664054df01997baace61d1defca77689798","versionType":"git","status":"affected"},{"version":"bf470f051556b610265ea02ad2102de75e8e619c","versionType":"git","status":"affected"},{"version":"4.19.100","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.16","lessThan":"5.5","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.5","status":"affected"},{"version":"0","lessThan":"5.5","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4bddcb346a6cf4615ca77f69a589623b877ca267","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4cff53bb19412c6f2d90b50678de5c3903f7f96a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94bbd65da4ae26592fa1977a74ee94218ab02a26","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a1f1d64a0a9791c842c4646253daf6ac0313eac7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b513a4c60a7aa1f4b4c2a48544ab003cb36f1e94","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7b6d67b43caee9183a4374d23641578ea556e6c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97923","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:19.413","lastModified":"2026-10-19T10:17:43.060","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Free histogram the var ref when its initialization fails\n\ncreate_var_ref() allocates a VAR_REF hist_field and then calls\ninit_var_ref() to fill it in. When that fails the field is leaked.\n\ncommit 656fe2ba85e8 (\"tracing: Use hist trigger's var_ref array to destroy\nvar_refs\") made destroy_hist_field() return early for\nHIST_FIELD_FL_VAR_REF, since var refs are freed by walking the trigger's\nvar_refs[] array instead. create_var_ref() adds the field to that array\nonly after init_var_ref() has succeeded, so on this path the field is in\nneither place and nothing frees it. The call was correct when it was\nwritten, before var refs were taken out of destroy_hist_field().\n\ninit_var_ref() cannot free it either. The caller owns the field, so\ninit_var_ref() undoes only its own string allocations and leaves the\nfield alone. Freeing it there would leave create_var_ref() passing freed\nmemory to destroy_hist_field(), which reads its flags.\n\nCall __destroy_hist_field(), which frees the field without consulting\nthe flag."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"656fe2ba85e81d00e4447bf77b8da2be3c47acb2","lessThan":"608b7751926ec08fae6a1ac4e7308195da68c362","versionType":"git","status":"affected"},{"version":"656fe2ba85e81d00e4447bf77b8da2be3c47acb2","lessThan":"4870f9071c9ea3c1423a07741b85a794db30d672","versionType":"git","status":"affected"},{"version":"656fe2ba85e81d00e4447bf77b8da2be3c47acb2","lessThan":"352f84a381e7b4651b30366e93cb858f3fa9c91a","versionType":"git","status":"affected"},{"version":"656fe2ba85e81d00e4447bf77b8da2be3c47acb2","lessThan":"4924328d6991f25b65bb7c8ff5d56c2a9b254851","versionType":"git","status":"affected"},{"version":"656fe2ba85e81d00e4447bf77b8da2be3c47acb2","lessThan":"74375caa20fe5165807b4334c783d1790b01f02a","versionType":"git","status":"affected"},{"version":"656fe2ba85e81d00e4447bf77b8da2be3c47acb2","lessThan":"222abcbe7866fef04563b6eb89fb21f627dcbc77","versionType":"git","status":"affected"},{"version":"656fe2ba85e81d00e4447bf77b8da2be3c47acb2","lessThan":"a69baeac38677270656e85753d93856a076dee57","versionType":"git","status":"affected"},{"version":"656fe2ba85e81d00e4447bf77b8da2be3c47acb2","lessThan":"516001d53e6b2ea95a251ee2ef54a1a689a3fd58","versionType":"git","status":"affected"},{"version":"836717841a30d7845cdf9cb806ee0ff3bfa7135a","versionType":"git","status":"affected"},{"version":"4.19.100","lessThan":"4.20","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/222abcbe7866fef04563b6eb89fb21f627dcbc77","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/352f84a381e7b4651b30366e93cb858f3fa9c91a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4870f9071c9ea3c1423a07741b85a794db30d672","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4924328d6991f25b65bb7c8ff5d56c2a9b254851","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/516001d53e6b2ea95a251ee2ef54a1a689a3fd58","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/608b7751926ec08fae6a1ac4e7308195da68c362","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74375caa20fe5165807b4334c783d1790b01f02a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a69baeac38677270656e85753d93856a076dee57","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97924","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:19.533","lastModified":"2026-10-19T10:17:43.180","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/user_events: Don't destroy fields when event removal fails\n\ndestroy_user_event() destroys the event's fields before attempting to\nremove the trace event call. If user_event_set_call_visible() fails,\ne.g. because the event is still enabled and trace_remove_event_call()\nreturns -EBUSY, the event is left registered with an irreversibly\ndestroyed field list. Any subsequent interaction with the event then\noperates on an empty field list while it is still fully visible in\ntracefs.\n\nMove the field destruction after the call removal, and splice the\nfield list back onto the event when the removal fails so the event\nremains in a consistent state."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7f5a08c79df35e68f1a43033450c5050f12bc155","lessThan":"a3d9b8b7c8f3627976fe758c77ffd3da260824d7","versionType":"git","status":"affected"},{"version":"7f5a08c79df35e68f1a43033450c5050f12bc155","lessThan":"9c62b7e92b6086a2a0aeb71f3553dd8cf7fdcd8b","versionType":"git","status":"affected"},{"version":"7f5a08c79df35e68f1a43033450c5050f12bc155","lessThan":"0892da2272ec565858aa1ec5458552d699de9142","versionType":"git","status":"affected"},{"version":"7f5a08c79df35e68f1a43033450c5050f12bc155","lessThan":"62d6544e86506bb0695c9594c713cba859666f2f","versionType":"git","status":"affected"},{"version":"7f5a08c79df35e68f1a43033450c5050f12bc155","lessThan":"2deb753127d7b7035e893955c5e91875e767d1f8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0892da2272ec565858aa1ec5458552d699de9142","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2deb753127d7b7035e893955c5e91875e767d1f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62d6544e86506bb0695c9594c713cba859666f2f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c62b7e92b6086a2a0aeb71f3553dd8cf7fdcd8b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3d9b8b7c8f3627976fe758c77ffd3da260824d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97925","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:19.680","lastModified":"2026-10-19T10:17:43.293","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntick/broadcast: Plug clockevents replacement race\n\n朱恺乾 reported and decoded the following race condition when a broadcast\ndevice is replaced:\n\nCPUA\t\t\t\t\tCPUB\n __tick_broadcast_oneshot_control()\n   bc = tick_broadcast_device.evtdev;\n\t\t\t\t\ttick_install_broadcast_device(dev)\n        \t\t\t\tclockevents_exchange_device(cur, dev)\n\t\t\t\t\t   shutdown(cur);\n\t\t\t\t\t   detach(cur);\n\t\t\t\t\t   cur->handler = noop;\n\t\t\t\t\t   tick_broadcast_device.evtdev = dev;\n\n  tick_broadcast_set_event(bc, next_event); <- FAIL: arms a detached device.\n\nIf the original broadcast device has a restricted interrupt affinity mask\nand the last CPU in that mask goes offline then the BUG() in\ntick_cleanup_dead_cpu() triggers because the clockevent device is not in\ndetached state.\n\nThe reason for this is that tick_install_broadcast_device() is not\nserialized vs. tick broadcast operations.\n\nThe obvious cure is to serialize tick_install_broadcast_device() with\ntick_broadcast_lock against a concurrent tick broadcast operation.\n\nThat requires to split clockevents_exchange_device() into two parts, one\nwhich does the exchange, shutdown and detach operation and the other which\ndrops the module reference count. This is required because the module\nreference cannot be dropped while holding tick_broadcast_lock.\n\nLet clockevents_exchange_device() do both operations as before, but let the\nbroadcast device code take the two step approach and do the device\nexchange under tick_broadcast_lock and drop the module reference count\nafter releasing it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/time/clockevents.c","kernel/time/tick-broadcast.c","kernel/time/tick-internal.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98","lessThan":"338d6859cd1580617807290f6d7e92b1662d4695","versionType":"git","status":"affected"},{"version":"f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98","lessThan":"757aa9f548c18b96da1d56d11f65be8188a16d59","versionType":"git","status":"affected"},{"version":"f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98","lessThan":"3da55616db2b6b7d9caa3b7ff1e8983224e0ed52","versionType":"git","status":"affected"},{"version":"f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98","lessThan":"3525b94b2f258e0b99d1ee5a82a80b51bc1cc818","versionType":"git","status":"affected"},{"version":"f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98","lessThan":"292b7a8ed84032cfdfc9076a690360f7d3f640d4","versionType":"git","status":"affected"},{"version":"f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98","lessThan":"113a9796effe3376d2ec5aabcca1fef4fef4cd62","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/time/clockevents.c","kernel/time/tick-broadcast.c","kernel/time/tick-internal.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.21","status":"affected"},{"version":"0","lessThan":"2.6.21","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/113a9796effe3376d2ec5aabcca1fef4fef4cd62","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/292b7a8ed84032cfdfc9076a690360f7d3f640d4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/338d6859cd1580617807290f6d7e92b1662d4695","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3525b94b2f258e0b99d1ee5a82a80b51bc1cc818","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3da55616db2b6b7d9caa3b7ff1e8983224e0ed52","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/757aa9f548c18b96da1d56d11f65be8188a16d59","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97926","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:19.833","lastModified":"2026-10-19T10:17:43.410","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nufs: validate cylinder group metadata before caching it\n\nufs_read_cylinder() copies the cylinder group index and the rotor\npositions straight from the on-disk group and caches them without any\ncheck:\n\n\tucpi->c_cgx    = fs32_to_cpu(sb, ucg->cg_cgx);\n\tucpi->c_rotor  = fs32_to_cpu(sb, ucg->cg_rotor);\n\tucpi->c_frotor = fs32_to_cpu(sb, ucg->cg_frotor);\n\tucpi->c_irotor = fs32_to_cpu(sb, ucg->cg_irotor);\n\nThey are then used as indices during allocation and free:\n\n  - c_cgx indexes the cylinder summary array as\n    UFS_SB(sb)->fs_cs(ucpi->c_cgx), so a value past s_ncg writes a 32\n    bit count outside the s_csp allocation.\n\n  - c_frotor becomes a bitmap scan start, start = c_frotor >> 3, and\n    then length = ((s_fpg + 7) >> 3) - start. A start beyond the block\n    bitmap wraps the unsigned length to a huge value, so ubh_scanc()\n    walks far past the cylinder group buffers. c_irotor drives the\n    inode bitmap the same way.\n\nA crafted image can set any of these freely, turning an ordinary\nallocation into an out of bounds access.\n\nReject a cylinder group whose recorded index does not match the group\nbeing read, or whose rotors fall outside the group, before the metadata\nis cached. Valid filesystems keep cg_cgx equal to the group number and\nthe rotors within the group, so only malformed images are rejected."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ufs/cylinder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"88cccb6beba136b73f0caf80e59457e1b3c0ca1e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f560a9e33365c460827c735fd86435f9213f1aed","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e4c5cc9688c3e69d07d888853388549ae26c0521","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"58c0c414b2b8d099d33da494a354fa836ca6c10b","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5902a95066883cf96fa15b2680694fc5dd0c7d11","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"87b12dc360a002eb2d498aa4f01e84347019612d","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"abde9eb33106850dfa367ad3965d3588bb8558d5","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c9d263be26806d388129fab8c6904bed197fc6af","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ufs/cylinder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/58c0c414b2b8d099d33da494a354fa836ca6c10b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5902a95066883cf96fa15b2680694fc5dd0c7d11","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87b12dc360a002eb2d498aa4f01e84347019612d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/88cccb6beba136b73f0caf80e59457e1b3c0ca1e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/abde9eb33106850dfa367ad3965d3588bb8558d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9d263be26806d388129fab8c6904bed197fc6af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e4c5cc9688c3e69d07d888853388549ae26c0521","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f560a9e33365c460827c735fd86435f9213f1aed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97927","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:19.950","lastModified":"2026-10-19T10:17:43.547","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nufs: create the root dentry after loading cylinder metadata\n\nufs_fill_super() installed sb->s_root before it loaded the cylinder\ngroup structures for a writable mount:\n\n\tsb->s_root = d_make_root(inode);\n\t...\n\tif (!sb_rdonly(sb))\n\t\tif (!ufs_read_cylinder_structures(sb))\n\t\t\tgoto failed;\n\nWhen ufs_read_cylinder_structures() failed, the error path freed the\nin-core superblock information and set sb->s_fs_info to NULL while\nsb->s_root stayed installed. get_tree_bdev() then reached\ndeactivate_locked_super(), and because s_root was present,\ngeneric_shutdown_super() called sync_filesystem() and the put_super\noperation. Both dereference UFS_SB(sb), which is now NULL, so a mount\nthat fails only while reading the cylinder groups oopses during\nteardown. A crafted image whose first cylinder group cannot be read\nreaches this path.\n\nLoad the cylinder group metadata first and create the root dentry last,\nso the superblock is published to the VFS only once it is fully set up.\nufs_setup_cstotal() and ufs_read_cylinder_structures() take only the\nsuper_block and do not use the root inode, so the reordering is safe."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ufs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e58db6c2dce6e453dca26c3a4953002425201880","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"05360c6eb8388bb5adac3c439ffb1512de39550a","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5cc48633fb76196b596a449ba1f4f642ad6125ce","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"cd21f1ff74b1c15077fa3b98e80da3b41055aae4","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a9804121d55aaa4319c1cac00b99794aa177dd6a","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"785e523b6c1931d802cab9f85912f3e6c7028af1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8173e051a8acbb4ae6547be0436727944119e0b5","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"55a4c98abb9694b067c6a031d11501f06b6b523c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ufs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/05360c6eb8388bb5adac3c439ffb1512de39550a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55a4c98abb9694b067c6a031d11501f06b6b523c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5cc48633fb76196b596a449ba1f4f642ad6125ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/785e523b6c1931d802cab9f85912f3e6c7028af1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8173e051a8acbb4ae6547be0436727944119e0b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a9804121d55aaa4319c1cac00b99794aa177dd6a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cd21f1ff74b1c15077fa3b98e80da3b41055aae4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e58db6c2dce6e453dca26c3a4953002425201880","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97928","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:20.063","lastModified":"2026-10-21T13:21:16.320","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: skip the VMID 0 flush for VRAM\n\nClear-on-release only runs on VRAM, which amdgpu_ttm_map_buffer() reaches\nvia its direct MC address without programming a GART window, yet the wipe\nstill forces a VMID 0 flush. On GFX11 (e.g. Navi33) that spurious SDMA\nflush can wedge the engine; only flush when a GART window is actually used.\n\nv2: Let amdgpu_ttm_map_buffer() return whether the VMID 0 flush is needed,\n    and drive the clear and copy paths from that. (Christian)\nv3: Make the vm_needs_flush output parameter mandatory instead of\n    allowing NULL. (Christian)\n\n(cherry picked from commit a306e406e570b74318ff7d80e5b07b540ca1d3a9)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a68c7eaa7a8ffdec9287ba1561a668d674c20a13","lessThan":"6593494733ccaf691db7bd13801583d188409607","versionType":"git","status":"affected"},{"version":"a68c7eaa7a8ffdec9287ba1561a668d674c20a13","lessThan":"30dacb56f07283a1acb353ce81baef31f85396b0","versionType":"git","status":"affected"},{"version":"a68c7eaa7a8ffdec9287ba1561a668d674c20a13","lessThan":"241d7450cf75969cea450eb3e740cb9682f69c2f","versionType":"git","status":"affected"},{"version":"a68c7eaa7a8ffdec9287ba1561a668d674c20a13","lessThan":"87ceb8cba73d0b3c4025ff42495bccd8164acaed","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/241d7450cf75969cea450eb3e740cb9682f69c2f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/30dacb56f07283a1acb353ce81baef31f85396b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6593494733ccaf691db7bd13801583d188409607","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87ceb8cba73d0b3c4025ff42495bccd8164acaed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97929","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:20.167","lastModified":"2026-10-21T13:21:16.457","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usbusx2y: validate URB actual_length in interrupt callback\n\ni_usx2y_in04_int() processes the interrupt URB data without checking\nurb->actual_length.  A short transfer from a malfunctioning device\nwould cause the handler to process uninitialized heap data from the\nkmalloc-allocated in04_buf, which is then copied to the mmap-accessible\nctl_snapshot[] array.\n\nFix by using kzalloc() for in04_buf to zero-initialize the buffer,\nand adding an actual_length check to skip processing on short\ntransfers while still resubmitting the URB."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/usx2y/usbusx2y.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c3576cb77b527f223cf2b9fc2b2e9af5e7adee25","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c156584999bf15118f523ef6c6fedc5b21f46bd9","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b0c30fe6c0d5902bd8a7d1d5720bead5bbe46f7d","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2770321b358658e0a39fe39ccf6a91ee97a81931","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8f5ef203abda9dd36b2af473c7b737d544f807bd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/usb/usx2y/usbusx2y.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2770321b358658e0a39fe39ccf6a91ee97a81931","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f5ef203abda9dd36b2af473c7b737d544f807bd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0c30fe6c0d5902bd8a7d1d5720bead5bbe46f7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c156584999bf15118f523ef6c6fedc5b21f46bd9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3576cb77b527f223cf2b9fc2b2e9af5e7adee25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97930","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:20.277","lastModified":"2026-10-19T10:17:43.873","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usbusx2y: fix in04_last array size mismatch with in04_buf\n\nThe in04_last array in struct usx2ydev is declared as char[24], but\nin04_buf is allocated as sizeof(struct us428_ctls) which is 21 bytes.\nIn i_usx2y_in04_int(), when ctl_snapshot_last == -2 (initialization\npath):\n\n    memcpy(usx2y->in04_last, usx2y->in04_buf, sizeof(usx2y->in04_last));\n\nThis copies 24 bytes from a 21-byte slab allocation, reading 3 bytes\npast the end of the source object.\n\nIntroduce a USX2Y_IN04_SIZE constant defined as sizeof(struct\nus428_ctls) and use it consistently for the in04_last array, the\nin04_buf allocation, the URB transfer length, and the comparison loop,\nreplacing the bare 24 and 21 literals throughout."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/usx2y/usbusx2y.c","sound/usb/usx2y/usbusx2y.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e75e4b0e647137f4c9f6dee4a7ef5b7b09e16f57","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"869fb83c072e884b80d93eab498e6040ffb010ba","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d170cfbe38c8817ac787f605655546a6d343017d","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"229cab526580f82839ae8e4e379753c8cf16952e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"381495b5b3da12d714e53d9d12d955b13fe26eac","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b5753bdfd909f7f095fb464d67802b5e52cbadbf","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"861111a14740e12c36d363e9830f8daa734279c9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/usb/usx2y/usbusx2y.c","sound/usb/usx2y/usbusx2y.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/229cab526580f82839ae8e4e379753c8cf16952e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/381495b5b3da12d714e53d9d12d955b13fe26eac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/861111a14740e12c36d363e9830f8daa734279c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/869fb83c072e884b80d93eab498e6040ffb010ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5753bdfd909f7f095fb464d67802b5e52cbadbf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d170cfbe38c8817ac787f605655546a6d343017d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e75e4b0e647137f4c9f6dee4a7ef5b7b09e16f57","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97931","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:20.387","lastModified":"2026-10-19T10:17:43.997","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: us122l: Prevent write upgrades for read mappings\n\nThe hwdep mmap callback rejects read-buffer mappings that are initially\nwritable, but leaves VM_MAYWRITE set on mappings created with PROT_READ.\nA process that can open the hwdep node O_RDWR can later use mprotect() to\nmake the mapping writable.\n\nThe read allocation begins with struct usb_stream. Its read_size member is\nused by the fault handler to decide which pages belong to the read buffer.\nThe read VMA intentionally remains expandable because pcm_usb_stream uses\nmremap() after reading that size. Changing read_size first can therefore\nmap and access pages beyond the allocation. The same member is also\nconsumed by usb_stream_free(), where changing it can make\nfree_pages_exact() release pages outside the allocation.\n\nClear VM_MAYWRITE for read-buffer mappings after rejecting an initially\nwritable VMA. This keeps the separate output-buffer mapping writable while\npreventing later permission upgrades."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/usx2y/us122l.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"030a07e441296c372f946cd4065b5d831d8dc40c","lessThan":"cbc1f954ce67d739d41d1f0757d29850353ebb6a","versionType":"git","status":"affected"},{"version":"030a07e441296c372f946cd4065b5d831d8dc40c","lessThan":"becb89036a1320ef0a77da2d27935ac0704345c4","versionType":"git","status":"affected"},{"version":"030a07e441296c372f946cd4065b5d831d8dc40c","lessThan":"6a5f5a5a32c78e67701f1d0f26bc87af68895604","versionType":"git","status":"affected"},{"version":"030a07e441296c372f946cd4065b5d831d8dc40c","lessThan":"938e8d6cee8d36f24669dfdcd3717e081eb32d64","versionType":"git","status":"affected"},{"version":"030a07e441296c372f946cd4065b5d831d8dc40c","lessThan":"64a87950239867682cde128020e1a47088295e5c","versionType":"git","status":"affected"},{"version":"030a07e441296c372f946cd4065b5d831d8dc40c","lessThan":"d9c537b14f4982f17b103e3a2cfeee4bee6bc026","versionType":"git","status":"affected"},{"version":"030a07e441296c372f946cd4065b5d831d8dc40c","lessThan":"0eb9dd4774af0ac4d1fd105ef2b0a1f6cec06f2f","versionType":"git","status":"affected"},{"version":"030a07e441296c372f946cd4065b5d831d8dc40c","lessThan":"71c610aeb1770302ac9c9e0b9a4ecd37f1311928","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/usb/usx2y/us122l.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.28","status":"affected"},{"version":"0","lessThan":"2.6.28","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0eb9dd4774af0ac4d1fd105ef2b0a1f6cec06f2f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64a87950239867682cde128020e1a47088295e5c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6a5f5a5a32c78e67701f1d0f26bc87af68895604","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/71c610aeb1770302ac9c9e0b9a4ecd37f1311928","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/938e8d6cee8d36f24669dfdcd3717e081eb32d64","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/becb89036a1320ef0a77da2d27935ac0704345c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cbc1f954ce67d739d41d1f0757d29850353ebb6a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9c537b14f4982f17b103e3a2cfeee4bee6bc026","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97932","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:20.500","lastModified":"2026-10-19T10:17:44.150","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Don't dereference trace_event_file in deferred trigger free\n\nThe enable_event trigger defers trace_event_put_ref() to the\ntrigger free kthread, but the trace_event_file can already be freed\nwhen the instance is removed.\n\nKeep the trace_event_call directly in enable_trigger_data so the\ndeferred free does not access the freed trace_event_file."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace.h","kernel/trace/trace_events_trigger.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e091351b38818ef620d27f44f4bfd625f13afbff","lessThan":"67fb91a7f7bb1d958cf9cc249c912bca9b2fc821","versionType":"git","status":"affected"},{"version":"e091351b38818ef620d27f44f4bfd625f13afbff","lessThan":"bcfe2816e6ec46c3f4c58aa4264476665ddb3f69","versionType":"git","status":"affected"},{"version":"159fdc3e01dca5fdbc412fcd8b239895733a270d","versionType":"git","status":"affected"},{"version":"7.1.6","lessThan":"7.2","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace.h","kernel/trace/trace_events_trigger.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/67fb91a7f7bb1d958cf9cc249c912bca9b2fc821","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bcfe2816e6ec46c3f4c58aa4264476665ddb3f69","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97933","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:20.610","lastModified":"2026-10-21T13:21:16.563","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Take trace_array reference when opening a tracer options file\n\nWhen a tracer option file is opened, it is passed a descriptor that points\nto an element on the trace_array's topts array. This element has\ninformation to find the trace array and other information. It uses this\nelement to take a reference of the trace_array so that the trace_array\ndoes not get removed while this file is opened.\n\nUnfortunately, there's a race condition where the element itself could be\nfreed by the removal of the instance the trace_array represents causing a\nuse-after-free as this element that is used to find the trace_array to\nincrement its reference counter is also freed when the instance is\nremoved.\n\nTo solve this, add a trace_array_tracer_options_get() helper function that\nwill take the address of the element that is passed to the open function\nby the inode->i_private pointer and search all the trace_arrays under a\nlock to find the one that the element's address is in the range of the\ntrace_arrays topts array elements. When a match happens, that trace_array's\nreference would be increased.\n\nNote, there's a race where if an admin was deleting and creating trace\ninstances at the same time and the memory of the old trace_array's array\nmatched the memory of the new trace_array that it could in theory open the\noption from the wrong trace array. But we do not care because it would be\nstupid to perform that kind of action. As long as the only thing that can\nhappen is that the option from the wrong trace array is used and doesn't\ncrash the kernel it will only make the user confused. But if they are\ndoing something stupid like this, they are already confused, so no harm\ndone."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace.c","kernel/trace/trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7e2cfbd2d3c86afcd5c26b5c4b1dd251f63c5838","lessThan":"61894ea0d2a1ae8ce903abf73bd56958c035f182","versionType":"git","status":"affected"},{"version":"7e2cfbd2d3c86afcd5c26b5c4b1dd251f63c5838","lessThan":"b2890064a12efbeb3b3c093e69e9010dd244c881","versionType":"git","status":"affected"},{"version":"7e2cfbd2d3c86afcd5c26b5c4b1dd251f63c5838","lessThan":"d9232a90c6f7de822177d35d73d9234cba523ef9","versionType":"git","status":"affected"},{"version":"7e2cfbd2d3c86afcd5c26b5c4b1dd251f63c5838","lessThan":"b2fb87d29ffb3a7a9ccc5acf12898ecb80587427","versionType":"git","status":"affected"},{"version":"7e2cfbd2d3c86afcd5c26b5c4b1dd251f63c5838","lessThan":"ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80","versionType":"git","status":"affected"},{"version":"952e477f908048145a5eb2ed3d431d9efc1e1073","versionType":"git","status":"affected"},{"version":"b3183f5f05cd867f5c17122773ca5aa8d07b51af","versionType":"git","status":"affected"},{"version":"bf38c1d29f8bfe9631b62a67f8dd1b8f7efb7139","versionType":"git","status":"affected"},{"version":"2617afde0c3db285778734b0ccad9a55b4f9cda2","versionType":"git","status":"affected"},{"version":"586787a0331aa2d7d244e9c4400d2a73295b0cf0","versionType":"git","status":"affected"},{"version":"5.4.257","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.10.197","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.15.133","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.55","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.5.5","lessThan":"6.6","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace.c","kernel/trace/trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/61894ea0d2a1ae8ce903abf73bd56958c035f182","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2890064a12efbeb3b3c093e69e9010dd244c881","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2fb87d29ffb3a7a9ccc5acf12898ecb80587427","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9232a90c6f7de822177d35d73d9234cba523ef9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97934","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:20.733","lastModified":"2026-10-21T13:21:16.713","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix memory corruption from a \"STACKTRACE\" histogram key\n\n\"cpu\", \"CPU\", \"stacktrace\" and \"STACKTRACE\" are generic fields, defined\nwith an offset and a size of zero so that the filter code can match them\nby name. parse_field() maps them onto their common_* equivalents for\nbackward compatibility, but unlike the common_* names it hands the\nplaceholder back to the caller instead of NULL.\n\ncreate_hist_field() takes a non-NULL field as a promise that the record\ncarries a stacktrace and picks HIST_FIELD_FN_STACK, so the __data_loc\nword is read from offset 0, that is from common_type, and its low 16\nbits are followed as an offset into the record. What is found there\nbecomes the length of an unbounded memcpy. Pick an event whose id is\nsmall enough that the offset stays inside its own record and the length\nis a kernel text address:\n\n  # cd /sys/kernel/tracing\n  # echo 'hist:keys=STACKTRACE' > events/ftrace/print/trigger\n  # echo hello > trace_marker\n\n  Oops: general protection fault, probably for non-canonical address\n  RIP: 0010:rb_next+0x23/0x60\n   </IRQ>\n  RIP: 0010:memcpy+0xc/0x30\n   event_hist_trigger+0x2e7/0x12c0\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nLeave the field NULL, which is what the comment above the branch says\nthe code does and what common_stacktrace already does. FILTER_CPU and\nFILTER_COMM are left alone, their create_hist_field() branches never\nlook at the field."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4b512860bdbdddcf41467ebd394f27cb8dfb528c","lessThan":"c94985e4fd77eb8634f44fb42e551563c68c55b3","versionType":"git","status":"affected"},{"version":"4b512860bdbdddcf41467ebd394f27cb8dfb528c","lessThan":"b6cc6ec5f032ea6fd5cce94fb83baab4d1c02e33","versionType":"git","status":"affected"},{"version":"4b512860bdbdddcf41467ebd394f27cb8dfb528c","lessThan":"9e026a91fe79966e2baabd4345c6e3a26975c729","versionType":"git","status":"affected"},{"version":"4b512860bdbdddcf41467ebd394f27cb8dfb528c","lessThan":"c27f8b68c05808bb4f2bcde0e6d1c954a4b65f8a","versionType":"git","status":"affected"},{"version":"4b512860bdbdddcf41467ebd394f27cb8dfb528c","lessThan":"7f711e62355bb3123a2ca2f97a2facbfebc678c6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/7f711e62355bb3123a2ca2f97a2facbfebc678c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e026a91fe79966e2baabd4345c6e3a26975c729","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6cc6ec5f032ea6fd5cce94fb83baab4d1c02e33","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c27f8b68c05808bb4f2bcde0e6d1c954a4b65f8a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c94985e4fd77eb8634f44fb42e551563c68c55b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97935","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:20.850","lastModified":"2026-10-21T13:21:16.847","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Set the trace clock before registering the histogram trigger\n\nhist_register_trigger() puts the trigger on the global named_triggers\nlist in cmd_ops->init(), and only then sets the trace clock:\n\n\tif (data->cmd_ops->init) {\n\t\tret = data->cmd_ops->init(data);\n\t\tif (ret < 0)\n\t\t\tgoto out;\n\t}\n\n\tif (hist_data->enable_timestamps) {\n\t\tret = tracing_set_clock(file->tr, hist_data->attrs->clock);\n\t\tif (ret) {\n\t\t\thist_err(tr, HIST_ERR_SET_CLOCK_FAIL, errpos(clock));\n\t\t\tgoto out;\n\t\t}\n\nThe clock string is not checked anywhere before that call, so a named\ntrigger using common_timestamp with an unknown clock fails after it has\nalready become findable. event_hist_trigger_parse() then frees it\nwithout taking it off the list, and the next lookup by name reads the\nfreed object:\n\n ~# cd /sys/kernel/tracing/events/sched/sched_switch\n ~# echo 'hist:name=foo:keys=common_pid:ts=common_timestamp:clock=bogus' > trigger\n bash: echo: write error: Invalid argument\n ~# echo 'hist:name=foo:keys=common_pid' > trigger\n\n  BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0\n  Read of size 8 at addr ffff88800915d760 by task init/1\n   find_named_trigger+0xac/0xc0\n   hist_register_trigger+0xc1/0x900\n   event_hist_trigger_parse+0x3146/0x6af0\n   event_trigger_write+0xce/0x160\n  Freed by task 63:\n   kfree+0x154/0x420\n   trigger_kthread_fn+0xfd/0x160\n\nSet the clock before the trigger is registered, so that nothing which\ncan fail runs after it is published, the way commit 6f86bdeab633\n(\"tracing: Fix bad hist from corrupting named_triggers list\") moved the\nregistration below the rest of the setup.\n\ntracing_set_filter_buffering() is reference counted, so the init failure\npath has to drop the reference that the clock block now takes first."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a4072fe85ba3671720cab0788291af953db27318","lessThan":"578d39ab420b18b76a12fc8d0573ec041a84da28","versionType":"git","status":"affected"},{"version":"a4072fe85ba3671720cab0788291af953db27318","lessThan":"cc6c4cf565b0c187c61ffd2e67a4dfb2427675ad","versionType":"git","status":"affected"},{"version":"a4072fe85ba3671720cab0788291af953db27318","lessThan":"cfad128171f8e2237a3c723d6478ef2cfb3b9127","versionType":"git","status":"affected"},{"version":"a4072fe85ba3671720cab0788291af953db27318","lessThan":"65d1e28198f344832a8a63e8ccf84b8f65b92a32","versionType":"git","status":"affected"},{"version":"a4072fe85ba3671720cab0788291af953db27318","lessThan":"6ede78d0563a2a3ae3e46f9c07cedb5d79645429","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/578d39ab420b18b76a12fc8d0573ec041a84da28","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65d1e28198f344832a8a63e8ccf84b8f65b92a32","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ede78d0563a2a3ae3e46f9c07cedb5d79645429","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc6c4cf565b0c187c61ffd2e67a4dfb2427675ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfad128171f8e2237a3c723d6478ef2cfb3b9127","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97936","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:20.963","lastModified":"2026-10-19T10:17:44.623","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix memory corruption from the histogram stacktrace modifier\n\nparse_field() sets HIST_FIELD_FL_STACKTRACE from the \".stacktrace\"\nmodifier before it looks the field name up, and nothing afterwards\nchecks that the name resolved to a field which holds a stacktrace.\ncreate_hist_field() picks HIST_FIELD_FN_STACK on the strength of the\nfield pointer alone, which reads a __data_loc word from the record and\nfollows its low 16 bits as an offset into the same record.\nevent_hist_trigger() takes the first word there as an entry count and\ncopies that many longs into a 31 entry array:\n\n\tn_entries = *stack;\n\tmemcpy(entries, ++stack, n_entries * sizeof(unsigned long));\n\nNeither end of that copy is bounded, and the count is whatever the event\nholds at the offset, so any field will do:\n\n  # cd /sys/kernel/tracing/events/sched/sched_process_fork\n  # echo 'hist:keys=parent_pid.stacktrace' > trigger\n  # (true)\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000008\n  RIP: 0010:rb_insert_color+0x18/0x130\n   timerqueue_linked_add+0x7e/0xd0\n   enqueue_hrtimer+0x39/0xb0\n   __hrtimer_run_queues+0x10f/0x1f0\n   </IRQ>\n  RIP: 0010:memcpy+0xc/0x30\n   event_hist_trigger+0x165/0x690\n\nThe timer interrupt landed on the rbtree the copy had already run over.\nNo debug options are needed for this; KASAN reports the same write as an\nout-of-bounds read of 13835058055416381440 bytes.\n\nDocumentation/trace/histogram.rst already states the rule, \"must be a\nlong[] type\", so enforce it once the name has been resolved. Names which\nresolve to no field at all, \"hitcount.stacktrace\" and the common_*\npseudo-fields, are refused for the same reason: they hold no stacktrace\nto read."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cc5fc8bfc961eeb99b7e8dffbeff7a3f6995d314","lessThan":"98da3379cdee343f671dac89b9afbd8b071f2591","versionType":"git","status":"affected"},{"version":"cc5fc8bfc961eeb99b7e8dffbeff7a3f6995d314","lessThan":"e183b84968d4a6ea476d806ea97668405aa56880","versionType":"git","status":"affected"},{"version":"cc5fc8bfc961eeb99b7e8dffbeff7a3f6995d314","lessThan":"57bfc2a17954d173d2a4182f3b582ffbb23aff64","versionType":"git","status":"affected"},{"version":"cc5fc8bfc961eeb99b7e8dffbeff7a3f6995d314","lessThan":"55caaf25da2c2bb9b75307e4c868726cb954b1d6","versionType":"git","status":"affected"},{"version":"cc5fc8bfc961eeb99b7e8dffbeff7a3f6995d314","lessThan":"a5e70ba87ca8ebc79b4e63de302d03b0625fe153","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/55caaf25da2c2bb9b75307e4c868726cb954b1d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57bfc2a17954d173d2a4182f3b582ffbb23aff64","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98da3379cdee343f671dac89b9afbd8b071f2591","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a5e70ba87ca8ebc79b4e63de302d03b0625fe153","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e183b84968d4a6ea476d806ea97668405aa56880","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97937","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:21.080","lastModified":"2026-10-19T10:17:44.750","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: fork: Initialize function graph state before copy_exec_state()\n\ndup_task_struct() copies the parent's task_struct, including ret_stack.\nftrace_graph_init_task() clears the copied function graph state, but it\ncurrently runs after copy_exec_state().\n\nFor non-CLONE_VM forks, copy_exec_state() allocates a new task_exec_state.\nIf that allocation fails, copy_process() reaches bad_fork_free and\nfree_task() calls ftrace_graph_exit_task(). Since the child still carries\nthe parent's ret_stack pointer, the unwind frees the parent's active\nfunction graph return stack. The parent subsequently accesses freed memory\nfrom function_graph_enter_regs().\n\nKASAN reports:\n\n[   22.190920] ==================================================================\n[   22.195899] BUG: KASAN: slab-use-after-free in function_graph_enter_regs+0xa76/0xb90\n[   22.200747] Write of size 8 at addr ff110000054dc0a8 by task repro/1\n[   22.205134]\n[   22.210770] CPU: 0 UID: 0 PID: 1 Comm: repro Not tainted 7.2.0-07732-g9328b3b03bdc-dirty #3 PREEMPT(lazy)\n[   22.212576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   22.213750] Call Trace:\n[   22.215271]  <TASK>\n[   22.216242]  ? ftrace_stub_direct_tramp+0x10/0x10\n[   22.217774]  dump_stack_lvl+0x4e/0x70\n[   22.220531]  print_report+0x157/0x4b4\n[   22.223202]  ? fixup_red_left+0x9/0x30\n[   22.224407]  ? complete_report_info+0x83/0x110\n[   22.226679]  ? function_graph_enter_regs+0xa76/0xb90\n[   22.228084]  kasan_report+0xce/0x100\n[   22.230109]  ? function_graph_enter_regs+0xa76/0xb90\n[   22.232860]  ? stack_trace_save+0x4/0xd0\n[   22.234156]  function_graph_enter_regs+0xa76/0xb90\n[   22.236090]  ? kasan_save_stack+0x30/0x50\n[   22.237752]  ? __pfx_function_graph_enter_regs+0x10/0x10\n[   22.238694]  ? ring_buffer_lock_reserve+0x345/0xf80\n[   22.239628]  ? stack_trace_save+0x4/0xd0\n[   22.242121]  ? stack_trace_save+0x4/0xd0\n[   22.243588]  ftrace_graph_func+0xda/0x160\n[   22.245362]  ? ftrace_stub_direct_tramp+0x10/0x10\n[   22.246520]  0xffffffffa0000095\n[   22.250528]  ? stack_trace_save+0x9/0xd0\n[   22.251757]  ? ring_buffer_unlock_commit+0x11d/0x5c0\n[   22.253152]  stack_trace_save+0x9/0xd0\n[   22.254264]  kasan_save_stack+0x30/0x50\n[   22.273631]  kasan_save_track+0x14/0x30\n[   22.276763]  kasan_save_free_info+0x3b/0x70\n[   22.278296]  __kasan_slab_free+0x43/0x70\n[   22.280157]  kmem_cache_free+0xbf/0x3b0\n[   22.282963]  ? ftrace_stub_direct_tramp+0x10/0x10\n[   22.284001]  free_task+0xa2/0x160\n[   22.285699]  ? ftrace_stub_direct_tramp+0x10/0x10\n[   22.286752]  copy_process+0x2aae/0x7bc0\n\nInitialize the child function graph state immediately after\ndup_task_struct(), before the first fallible operation."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/fork.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6b1c66c9cca99bf00386481c7b2aa7394c26d8b8","lessThan":"1fadebbbf31f65beba353fa9d1373bf183e03fed","versionType":"git","status":"affected"},{"version":"6b1c66c9cca99bf00386481c7b2aa7394c26d8b8","lessThan":"08cacffeef8f64f1a222c93467ca84f24a46c953","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/fork.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/08cacffeef8f64f1a222c93467ca84f24a46c953","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1fadebbbf31f65beba353fa9d1373bf183e03fed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97938","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:21.193","lastModified":"2026-10-21T13:21:16.970","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nreboot: fix cad_pid use-after-free race\n\ncad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()\nreads it and passes it to pid_vnr() without protecting the lifetime of\nthe referenced struct pid. A concurrent writer can replace cad_pid and\ndrop the final reference to the old struct pid after the reader has\nloaded the pointer but before pid_vnr() has finished dereferencing it,\ncausing a use-after-free.\n\nkill_cad_pid() has the same lifetime race when it passes cad_pid to\nkill_pid().\n\nAt the time this issue was reported, an unprivileged user could reach the\nsysctl through user and PID namespaces because cad_pid was registered in\npid_table[]. Moving cad_pid back to the global reboot sysctl table\ncorrected that namespace and permission mismatch, but did not fix the\nunderlying lifetime race.\n\nFix this by treating cad_pid as an RCU-protected pointer at both read\nsites and by waiting for a grace period before dropping the old reference\non the write side.\n\ncall_rcu(&old_pid->rcu, ...) cannot be used here because free_pid()\nalso queues pid->rcu; queueing the same rcu_head twice can corrupt the\nRCU callback list.\n\nOriginal KASAN crash stack:\n  kernel/pid.c:545 pid_nr_ns()        # reads freed pid->level\n  kernel/pid.c:556 pid_vnr()          # calls pid_nr_ns()\n  kernel/pid.c:775 proc_do_cad_pid()  # calls pid_vnr(cad_pid)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/sched.h","include/linux/sched/signal.h","init/main.c","kernel/reboot.c","kernel/signal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9ec52099e4b8678a60e9f93e41ad87885d64f3e6","lessThan":"0c1a966bc047af2801a70b8eb13f9df5d7ab925f","versionType":"git","status":"affected"},{"version":"9ec52099e4b8678a60e9f93e41ad87885d64f3e6","lessThan":"ae3e53fe3c1241855e3a88f74877738349948c78","versionType":"git","status":"affected"},{"version":"9ec52099e4b8678a60e9f93e41ad87885d64f3e6","lessThan":"ad72e2566643fff7f01666d845fb026898155e1f","versionType":"git","status":"affected"},{"version":"9ec52099e4b8678a60e9f93e41ad87885d64f3e6","lessThan":"9a17b0e053197a6a42cdc75e75a35b17aa662088","versionType":"git","status":"affected"},{"version":"9ec52099e4b8678a60e9f93e41ad87885d64f3e6","lessThan":"5a88f78df753993469dab4d1831f8fb4256a9468","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/sched.h","include/linux/sched/signal.h","init/main.c","kernel/reboot.c","kernel/signal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.19","status":"affected"},{"version":"0","lessThan":"2.6.19","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0c1a966bc047af2801a70b8eb13f9df5d7ab925f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5a88f78df753993469dab4d1831f8fb4256a9468","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a17b0e053197a6a42cdc75e75a35b17aa662088","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad72e2566643fff7f01666d845fb026898155e1f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae3e53fe3c1241855e3a88f74877738349948c78","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97939","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:21.303","lastModified":"2026-10-21T13:21:17.107","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipmr: account multicast table and route memory\n\nA netadmin in a user+net namespace can create many IPv4 and IPv6\nmulticast routing tables with MRT_TABLE and MRT6_TABLE. Each unseen\nid allocates an mr_table via the shared mr_table_alloc(), links it\ninto the per-net list, and leaves it until netns teardown. Those\nobjects were not charged to memcg, so the host unreclaimable slab\ngrows with the table count.\n\nAccount mr_table allocations with GFP_KERNEL_ACCOUNT and mark the\nIPv4/IPv6 MFC caches SLAB_ACCOUNT. This matches the established\nhandling of IP addresses, routes and alternate interface names.\n\nUnresolved MFC entries are still allocated from softIRQ with\nGFP_ATOMIC and are not charged. They expire after 10 seconds and are\nbounded by the socket receive queue; see commit 0079ad8e8dc3\n(\"ipmr: remove hard code cache_resolve_queue_len limit\")."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/ipmr.c","net/ipv4/ipmr_base.c","net/ipv6/ip6mr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f0ad0860d01e47a3ffd220564c5c653b3afbe962","lessThan":"21e0749e8ef272ac7e3eefe0fa488a5983f4b038","versionType":"git","status":"affected"},{"version":"f0ad0860d01e47a3ffd220564c5c653b3afbe962","lessThan":"ec1c6140394ee87127479bc500a3158b125bf07a","versionType":"git","status":"affected"},{"version":"f0ad0860d01e47a3ffd220564c5c653b3afbe962","lessThan":"0264b3ee09b118fec8a5471b4ca288f8ab84722f","versionType":"git","status":"affected"},{"version":"f0ad0860d01e47a3ffd220564c5c653b3afbe962","lessThan":"d0a2e2a4ee6bfe51e398bfb6921a7d0f4c26bc1c","versionType":"git","status":"affected"},{"version":"f0ad0860d01e47a3ffd220564c5c653b3afbe962","lessThan":"b7ee18725f2292ab554aa96a101ae42d45f008bd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/ipmr.c","net/ipv4/ipmr_base.c","net/ipv6/ip6mr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.35","status":"affected"},{"version":"0","lessThan":"2.6.35","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0264b3ee09b118fec8a5471b4ca288f8ab84722f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/21e0749e8ef272ac7e3eefe0fa488a5983f4b038","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b7ee18725f2292ab554aa96a101ae42d45f008bd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0a2e2a4ee6bfe51e398bfb6921a7d0f4c26bc1c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ec1c6140394ee87127479bc500a3158b125bf07a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97940","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:21.410","lastModified":"2026-10-19T10:17:45.110","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix fib6 walker UAF on seq stop\n\nipv6_route_iter_active() treats a walker in FWS_U at the table root as\nalready unlinked. fib6_del_route() can move a still-linked walker into\nthat same state when the current leaf is the last route at the root,\nso ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq\nprivate object can then be freed while it remains on\nnet->ipv6.fib6_walkers. A later route deletion walks the dangling list\nand uses the freed walker.\n\nUse the list head as membership state and reinitialize it when\nunlinking. Keep the existing w->node check so a never-started iterator\nwith a zeroed private object is not treated as linked.\n\nThe same stop helper is used by /proc/net/ipv6_route and by the BPF\nipv6_route iterator. The BPF show path only widens the race."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/ip6_fib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7","lessThan":"9a3f73d62c86271614eda4c43315230896a37018","versionType":"git","status":"affected"},{"version":"8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7","lessThan":"63407cddabc5992b5ac03af165559f4a1968a032","versionType":"git","status":"affected"},{"version":"8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7","lessThan":"05b687ee04f816658f4a9cf586f4d2f129157943","versionType":"git","status":"affected"},{"version":"8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7","lessThan":"14fdaba201fdff92a3e45994e02bccda409cb19d","versionType":"git","status":"affected"},{"version":"8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7","lessThan":"0eede1689610e9eeaf729ba86fd1321799eb91a0","versionType":"git","status":"affected"},{"version":"8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7","lessThan":"b89b691dd00bf39b9ba39ab9446f8c62f419fa7b","versionType":"git","status":"affected"},{"version":"8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7","lessThan":"4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02","versionType":"git","status":"affected"},{"version":"8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7","lessThan":"19b4ed644d68098cc62ab612727f40d30f43476c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/ip6_fib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.13","status":"affected"},{"version":"0","lessThan":"3.13","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/05b687ee04f816658f4a9cf586f4d2f129157943","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0eede1689610e9eeaf729ba86fd1321799eb91a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/14fdaba201fdff92a3e45994e02bccda409cb19d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/19b4ed644d68098cc62ab612727f40d30f43476c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/63407cddabc5992b5ac03af165559f4a1968a032","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a3f73d62c86271614eda4c43315230896a37018","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b89b691dd00bf39b9ba39ab9446f8c62f419fa7b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97941","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:21.517","lastModified":"2026-10-19T10:17:45.267","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race\n\nCommit ba7425312607 (\"mm, slab: add an optimistic\n__slab_try_return_freelist()\") incorrectly assumed that nobody has freed\nan object to the slab as long as slab->freelist is NULL and cmpxchg\nsucceeds.\n\nHowever, as reported by Hyunwoo Kim [1], other CPUs might have freed\nan object to the slab, insert the slab to the partial list, then\nallocated an object from the slab, and be in the middle of removing\nthe slab from the list under n->list_lock.\n\nSince __refill_objects_node() puts the slab back on pc.slabs\noutside n->list_lock, it might insert the slab into that list while\nthe slab is concurrently being removed from n->partial.\nThis led to a list corruption [1]:\n\n  list_add corruption. next->prev should be prev\n  (ffff888100000248), but was dead000000000122.\n  (next=ffffea000416e410).\n  kernel BUG at lib/list_debug.c:29!\n  Oops: invalid opcode: 0000 [#1] SMP NOPTI\n  CPU: 1 UID: 65534 PID: 144 Comm: poc Not tainted\n  7.2.0-16172-gcf72cbb39da8-dirty #1 PREEMPT(lazy)\n  RIP: 0010:__list_add_valid_or_report+0x80/0xd0\n  ...\n  Call Trace:\n   alloc_from_new_slab+0x183/0x300\n   ___slab_alloc+0x31c/0x890\n   __kmalloc_noprof+0x3d4/0x800\n   lsm_blob_alloc+0x2d/0x50\n   security_msg_msg_alloc+0x26/0x90\n   load_msg+0x1aa/0x210\n   do_msgsnd+0x91/0x800\n   do_syscall_64+0x109/0x5d0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  ...\n  Kernel panic - not syncing: Fatal exception\n\nThis is a classic ABA problem where cmpxchg succeeds but the state has\nchanged since __refill_objects_node() took the freelist from the slab.\n\nAs Vlastimil Babka mentioned [2], it should be rare to return more than\none slab (due to the racy read of slab->counters in\nget_partial_node_bulk()). Therefore, instead of introducing additional\ncomplexity, acquire and release n->list_lock twice in the worst case.\n\nReturn the slab directly to the partial list and hold n->list_lock\nacross the cmpxchg and add_partial(). This is similar to the initial\nversion of commit ba7425312607 [3]. This is enough to avoid the race as\nthe list manipulation is serialized by n->list_lock. While at it,\nbring back unlikely() hint now that the condition is unlikely."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/slub.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ba742531260782a2646bc031f9a12cafebc22594","lessThan":"570a6aaf6b52c6ec098f4811cdb52b1496f13d15","versionType":"git","status":"affected"},{"version":"ba742531260782a2646bc031f9a12cafebc22594","lessThan":"4a724bcf5d703e18957397914d79156fa2cf1174","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/slub.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/4a724bcf5d703e18957397914d79156fa2cf1174","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/570a6aaf6b52c6ec098f4811cdb52b1496f13d15","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97942","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:21.633","lastModified":"2026-10-19T10:17:45.403","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/alternatives: Exclude text poking against change_page_attr()\n\nFrom time to time, the following BUG can be observed\nin the x86 alternatives patching code [0]:\n\n  > kernel BUG at arch/x86/kernel/alternative.c:2576!\n  > Oops: invalid opcode: 0000 [#1] SMP NOPTI\n  > CPU: 0 UID: 0 PID: 355 Comm: (udev-worker) Not tainted 7.1.3-1-default #1 PREEMPT(full) openSUSE Tumbleweed  8c1795b03ec64f997e57a8ad38b1161e3b98da64\n  > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022\n  > RIP: 0010:__text_poke+0x2aa/0x450\n  > Call Trace:\n  >  <TASK>\n  >  smp_text_poke_batch_finish+0x2a7/0x320\n  >  __static_call_transform+0xb7/0x220\n  >  arch_static_call_transform+0x5b/0xb0\n  >  __static_call_init+0xe9/0x270\n  >  static_call_module_notify+0x11f/0x150\n  >  notifier_call_chain+0x61/0xe0\n  >  blocking_notifier_call_chain_robust+0x63/0xc0\n  >  load_module+0x1c92/0x20c0\n  >  init_module_from_file+0xd8/0x140\n  >  idempotent_init_module+0x100/0x2f0\n  >  __x64_sys_finit_module+0x71/0xe0\n  >  do_syscall_64+0xe1/0x610\n  >  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nwhich matches the following BUG_ON() in alternative.c:\n\n\t/*\n\t * If something went wrong, crash and burn since recovery paths are not\n\t * implemented.\n\t */\n\tBUG_ON(!pages[0] || (cross_page_boundary && !pages[1]));\n\nThis can happen if vmalloc_to_page() fails, for any reason. Such can happen\nif text poking races with CPA, which can possibly result in the collapsing\nof page tables (or breaking of PMD hugepages). It is not a problem for most\nusers of vmalloc_to_page() (they solely own the vmalloc'd range) but, when\nCONFIG_ARCH_HAS_EXECMEM_ROX=y, various modules own a single execmem vmalloc\nrange, and can call set_memory_*() in parallel on it. This can happen to\nrace against __text_poke and cause havoc in vmalloc_to_page().\n\nFix it by excluding against CPA using the init_mm mmap read lock.\n\n[ dhansen: Fix up SoB ordering. The actual code flow here was:\n\t   Pedro=>Lorenzo=>Mike=>Me which is reflected in the SoB chain\n\t   now. I *believe* Mike simply picked up Lorenzo's update to\n\t   Pedro's post from the Link ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/kernel/alternative.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"64f6a4e10c05ed527f0f24b7954964255e0d3535","lessThan":"281e6f536f2f3f95d91938c5bd7ba9bcb4c1049d","versionType":"git","status":"affected"},{"version":"64f6a4e10c05ed527f0f24b7954964255e0d3535","lessThan":"89c60435b90d32ab5e3a39da3ae73d463d07debe","versionType":"git","status":"affected"},{"version":"64f6a4e10c05ed527f0f24b7954964255e0d3535","lessThan":"1587d3394e254639cc36516256031334095e6ef3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/kernel/alternative.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1587d3394e254639cc36516256031334095e6ef3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/281e6f536f2f3f95d91938c5bd7ba9bcb4c1049d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/89c60435b90d32ab5e3a39da3ae73d463d07debe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97943","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:21.750","lastModified":"2026-10-19T10:17:45.520","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF\n\nx86 implements page attribute modification using its Change Page\nAttributes (CPA) mechanism.\n\nThis tracks properties of ranges such as cache mode through x86 page\nattributes, and as part of that logic manipulates kernel page tables.\n\nSince commit:\n\n  41d88484c71c (\"x86/mm/pat: restore large ROX pages after fragmentation\")\n\nranges of kernel page table entries can be collapsed into\nhuge page table entries as part of this logic.\n\nAs part of this collapse, it frees the page tables which the collapsed\nentries previously pointed to, and it does so without any relevant locks\nbeing held to preclude concurrent kernel page table walkers.\n\nThe only way this code can be reached is if CPA_COLLAPSE is specified, and\nthis is only set in set_memory_rox() via:\n\nset_memory_rox()\n-> change_page_attr_set_clr()\n-> cpa_flush()\n-> cpa_collapse_large_pages()\n\nNotable users of this are execmem and BPF when manipulating executable\nmappings.\n\nHowever, this is problematic for ptdump as it walks ranges it does not own\nand thus runs the risk of a use-after-free on page tables freed underneath\nit.\n\nIn addition, concurrent CPA collapse operations are possible which can also\ncause races.\n\nResolve the issue by acquiring the mmap write lock on init_mm across the\nwhole operation.\n\nIt is safe to acquire a sleeping lock as all the callers invoke\nset_memory_rox() from process context and in any case,\nchange_page_attr_set_clr() calls vm_unmap_alias() which ultimately takes a\nmutex, disallowing atomic context here."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/mm/pat/set_memory.c","include/linux/mmap_lock.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"41d88484c71cd4f659348da41b7b5b3dbd3be1f6","lessThan":"35820cf8dd521f5a651e221483015b0586794516","versionType":"git","status":"affected"},{"version":"41d88484c71cd4f659348da41b7b5b3dbd3be1f6","lessThan":"93b98882198b15bd482da1fe8e84b05c7c3b3d83","versionType":"git","status":"affected"},{"version":"41d88484c71cd4f659348da41b7b5b3dbd3be1f6","lessThan":"a1c7570cedd03372812a5b693732880867babbca","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/mm/pat/set_memory.c","include/linux/mmap_lock.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/35820cf8dd521f5a651e221483015b0586794516","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/93b98882198b15bd482da1fe8e84b05c7c3b3d83","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a1c7570cedd03372812a5b693732880867babbca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97944","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:21.870","lastModified":"2026-10-19T10:17:45.640","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()\n\nThe switch of the FineIBT preamble from \"subl $hash, %r10d\" to the\nshorter \"subl $hash, %eax\" moved the hash immediate from offset 7 to\noffset 5 of the preamble. fineibt_preamble_hash was updated to match,\nbut the open-coded offset in cfi_get_func_hash() was missed and it\nstill reads the hash at offset 7.\n\ncfi_get_func_hash() is used by the BPF JIT to give a struct_ops\ntrampoline the CFI hash of the stub function it stands in for. With\nFineIBT the trampoline now gets the upper half of the real hash\nfollowed by the first two bytes of the next instruction, so the first\nindirect call from the kernel into a struct_ops program,\ntcp_init_congestion_control() calling ->init() of a BPF congestion\ncontrol for example, fails the FineIBT check and the kernel dies with\na CFI failure.\n\nMove the FineIBT preamble template and its offset defines above\ncfi_get_func_hash() and use fineibt_preamble_hash there, so every\nreader of the preamble shares one definition of its layout. The\nCFI_FINEIBT arm is only built with CONFIG_FINEIBT, the only\nconfiguration in which cfi_mode can take that value.\ncfi_get_func_arity() does not need the same treatment: the __bhi_args\ncall whose displacement it reads still ends at the function address."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/kernel/alternative.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5","lessThan":"cd9b4595d6283f9b8a35d7ae607508de45a351ce","versionType":"git","status":"affected"},{"version":"85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5","lessThan":"67cf94c30a8b5ebc839f282f5c5a522b35903524","versionType":"git","status":"affected"},{"version":"85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5","lessThan":"5a5d26f2cfe13467166219f6bf58099326912ddb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/kernel/alternative.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5a5d26f2cfe13467166219f6bf58099326912ddb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/67cf94c30a8b5ebc839f282f5c5a522b35903524","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cd9b4595d6283f9b8a35d7ae607508de45a351ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97945","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:21.983","lastModified":"2026-10-19T10:17:45.740","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Fix user-space data loss with MADV_FREE and THP\n\nSome of users of Polars (a data analytics library) have lost production\ndata from this bug. They seem to have just the right combination of\nhuge pages, MADV_FREE and heavy reclaim pressure.\n\npmd_modify() masks the old value with (_HPAGE_CHG_MASK & ~_PAGE_DIRTY),\nsilently discarding the hardware dirty bit.  The subsequent\npmd_mksaveddirty() call is supposed to transfer _PAGE_DIRTY into\n_PAGE_SAVED_DIRTY when write-protecting, but the dirty bit was already\nstripped from the value, so there is nothing left to transfer.\n\nContrast with pte_modify(), which keeps _PAGE_DIRTY_BITS in its mask,\nand pud_modify(), which keeps _HPAGE_CHG_MASK untouched: pmd_modify()\nis the odd one out.  Any pmd_modify() on a writable, dirty PMD loses\nthe dirty state.\n\nOne visible consequence is data loss with MADV_FREE on PMD-mapped THP:\n\n    memset(buf, 0x5A, size);          // PMD-mapped THP, PMD dirty\n    madvise(buf, size, MADV_FREE);    // PMD cleaned but left writable,\n                                      // folio marked lazyfree\n    memset(buf, 0x5A, size);          // hardware sets _PAGE_DIRTY again\n    mprotect(buf, size, PROT_READ);   // pmd_modify() drops the dirty bit\n    mprotect(buf, size, PROT_READ|PROT_WRITE);\n    // ... memory pressure ...\n\nReclaim (e.g. under memcg pressure) then finds the lazyfree folio with\nno dirty bit set anywhere and frees it in\n__discard_anon_folio_pmd_locked(), even though the data was rewritten\nafter MADV_FREE; subsequent reads fault in fresh zero pages.  NUMA\nhinting alone can trigger the same loss, as do_huge_pmd_numa_page()\nrestores the PMD through pmd_modify() as well.\n\nPMD-mapped file THPs are affected too: mprotect()/NUMA hinting dropping\nthe dirty bit means rewritten data is never written back.\n\nFix it by keeping _PAGE_DIRTY in the preserved mask, exactly like\npte_modify() and pud_modify() do.  The existing\npmd_mksaveddirty()/pmd_clear_saveddirty() pair then performs the\nhardware-dirty <-> saved-dirty transition based on the write bit,\npreserving the shadow-stack encoding rules."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/include/asm/pgtable.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bb3aadf7d446aaf22c725b274e2c194ac5cb2111","lessThan":"b5dec6dfb593d81fec15ba43c4fe5d58f10a49a2","versionType":"git","status":"affected"},{"version":"bb3aadf7d446aaf22c725b274e2c194ac5cb2111","lessThan":"e4d569fe2f436a9b58c048fefabf56eab68c1b7e","versionType":"git","status":"affected"},{"version":"bb3aadf7d446aaf22c725b274e2c194ac5cb2111","lessThan":"55ddbc2ca6d5db64d44c3fb8f8705b4d39eb30b7","versionType":"git","status":"affected"},{"version":"bb3aadf7d446aaf22c725b274e2c194ac5cb2111","lessThan":"a5ad97cbcfcec31430268441c10eedde73200177","versionType":"git","status":"affected"},{"version":"bb3aadf7d446aaf22c725b274e2c194ac5cb2111","lessThan":"f7491d7c81db0e7c304a7bd757a76d2fbeaff80e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/include/asm/pgtable.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/55ddbc2ca6d5db64d44c3fb8f8705b4d39eb30b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a5ad97cbcfcec31430268441c10eedde73200177","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5dec6dfb593d81fec15ba43c4fe5d58f10a49a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e4d569fe2f436a9b58c048fefabf56eab68c1b7e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f7491d7c81db0e7c304a7bd757a76d2fbeaff80e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97946","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:22.110","lastModified":"2026-10-19T10:17:45.850","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/amd_node: Fix PCI device reference counting in amd_smn_init()\n\nThe local \"root\" pointer is a temporary variable used during the device\nsearch. Therefore, refcount related to the search iterators should be cleaned\nup after the search is complete.\n\nUse the __free() cleanup macro to ensure the refcount is decremented when the\ntemporary pointer goes out of scope.\n\nAdditionally, increment the refcount when caching a root pointer. This ensures\nthe in-use refcount is separate from the temporary search refcounting.\n\nFinally, drop the redundant \"root = NULL\" before the second search loop. The\npci_get_class() iterator always decrements the refcount of its \"from\"\nargument, so the first loop can only fall through with \"root\" already NULL."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/kernel/amd_node.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0a4b61d9c2e496b5f0a10e29e355a1465c8738bb","lessThan":"84e3a71d11d8593c127b468d75b2653af5074f81","versionType":"git","status":"affected"},{"version":"0a4b61d9c2e496b5f0a10e29e355a1465c8738bb","lessThan":"aa2a4277ad42fd8f918c6dc652473946a253f7b0","versionType":"git","status":"affected"},{"version":"0a4b61d9c2e496b5f0a10e29e355a1465c8738bb","lessThan":"27600805e62f800bacf990354632eae4e487d34c","versionType":"git","status":"affected"},{"version":"c4ad899a33198ab6335732c769835d035e66894a","versionType":"git","status":"affected"},{"version":"6.17.8","lessThan":"6.18","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/kernel/amd_node.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/27600805e62f800bacf990354632eae4e487d34c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/84e3a71d11d8593c127b468d75b2653af5074f81","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa2a4277ad42fd8f918c6dc652473946a253f7b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97947","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:22.213","lastModified":"2026-10-19T10:17:45.937","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/amd_node: Fix potential NULL pointer dereference\n\namd_smn_read/write() are exported functions around __amd_smn_rw(), so\nthey are always available even if amd_smn_init() fails. In that case,\n'amd_roots' is NULL and __amd_smn_rw() will access uninitialized memory.\n\nThen, commit:\n\n  83518453074d (\"x86/amd_node: Add SMN offsets to exclusive region access\")\n\nadded the 'smn_exclusive' flag, which indicated the calls to\npci_request_config_region_exclusive() succeeded, to prevent\nconcurrent userspace access.\n\nCommit:\n\n  0a4b61d9c2e4 (\"x86/amd_node: Fix AMD root device caching\")\n\nre-ordered initialization so pci_request_config_region_exclusive() is\ncalled earlier and a failure exits amd_smn_init() before allocating\n'amd_roots'. The setting of 'smn_exclusive' moved to the end of\namd_smn_init(), after 'amd_roots' is allocated. It became redundant\nand can be removed.\n\nReplace 'smn_exclusive' with directly checking 'amd_roots', to fix a\npotential NULL pointer dereference and to simplify the logic.\n\n  [ bp: Reorg commit message, touchup comment. ]\n  [ mingo: Rebase & further touchups. ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/kernel/amd_node.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"77466b798d59d6761501ff36094cf430d3876549","lessThan":"fcd19bc829eca237742a3b123f839ad1c473ec85","versionType":"git","status":"affected"},{"version":"77466b798d59d6761501ff36094cf430d3876549","lessThan":"a797a2331e5d2ecdbccbae222ea71c759fdb2c2b","versionType":"git","status":"affected"},{"version":"77466b798d59d6761501ff36094cf430d3876549","lessThan":"aefdbd574a362dcf7569bada6d72f64a006b9fb9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/kernel/amd_node.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/a797a2331e5d2ecdbccbae222ea71c759fdb2c2b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aefdbd574a362dcf7569bada6d72f64a006b9fb9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fcd19bc829eca237742a3b123f839ad1c473ec85","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97948","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:22.317","lastModified":"2026-10-19T10:17:46.023","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/eeh: Fix recursive locking on devices without EEH sensitive driver\n\nThe commit 1010b4c012b0 (\"powerpc/eeh: Make EEH driver device hotplug\nsafe\") refactored the EEH code such that the pci_rescan_remove_lock is\nheld at the beginning of eeh_handle_normal_event() and the\neeh_reset_device() is called with that lock being held. Looks like the\ncommit missed to remove the existing lock/unlock inside eeh_rmv_device()\nwhich is no longer necessary. This is causing the eehd to hang on the\nlock which it actually holds when that code path is taken.\n\n[<0>] 0xc00000011c78f870\n[<0>] __switch_to+0xfc/0x1a0\n[<0>] pci_lock_rescan_remove+0x30/0x44\n[<0>] eeh_rmv_device+0x290/0x2e0\n[<0>] eeh_pe_dev_traverse+0x80/0x130\n[<0>] eeh_reset_device+0xcc/0x23c\n[<0>] eeh_handle_normal_event+0x830/0xa80\n[<0>] eeh_event_handler+0xf8/0x190\n[<0>] kthread+0x194/0x1b0\n[<0>] start_kernel_thread+0x14/0x18\n\nThe issue is seen for cases where the errors are detected on the PHB\ndirectly AND|OR for devices where the driver error_detected() returns\nPCI_ERS_RESULT_NEED_RESET, and driver being not EEH sensitive(i.e no\nerror handlers like slot_reset(), resume() etc defined)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/powerpc/kernel/eeh_driver.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"502f08831a9afb72dc98a56ae6504da43e93b250","lessThan":"3833dfae0680b6b16e2469fbc90aa48376311cd8","versionType":"git","status":"affected"},{"version":"f56e004b781719d8fdf6c9619b15caf2579bc1f2","lessThan":"24524fca27da674668941440e8e05cdfec0b0222","versionType":"git","status":"affected"},{"version":"59c6d3d81d42bf543c90597b4f38c53d6874c5a1","lessThan":"a58531181363219fa5de2b53d5d7274dcdfca98b","versionType":"git","status":"affected"},{"version":"a426e8a6ae161f51888585b065db0f8f93ab2e16","lessThan":"460fab22b65138531082910702f74b048b25237b","versionType":"git","status":"affected"},{"version":"d2c60a8a387e9fcc28447ef36c03f8e49fd052a6","lessThan":"102e3dc5ab5ba052e294819e83384166b242c1ec","versionType":"git","status":"affected"},{"version":"1010b4c012b0d78dfb9d3132b49aa2ef024a07a7","lessThan":"2920af33d097ca335e492b346af70b72986ad6dc","versionType":"git","status":"affected"},{"version":"1010b4c012b0d78dfb9d3132b49aa2ef024a07a7","lessThan":"85d8eaefc052cf3e5ae2c7bafeda2db68b8898b4","versionType":"git","status":"affected"},{"version":"1010b4c012b0d78dfb9d3132b49aa2ef024a07a7","lessThan":"c5e68706527968282e49de205cc2b935823cb88a","versionType":"git","status":"affected"},{"version":"d42bbd8f30ac38b1ce54715bf08ec3dac18d6b25","versionType":"git","status":"affected"},{"version":"19d5036e7ad766cf212aebec23b9f1d7924a62bc","versionType":"git","status":"affected"},{"version":"5.10.241","lessThan":"5.10.271","versionType":"semver","status":"affected"},{"version":"5.15.190","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"6.1.148","lessThan":"6.1.189","versionType":"semver","status":"affected"},{"version":"6.6.102","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.12.42","lessThan":"6.12.111","versionType":"semver","status":"affected"},{"version":"6.15.10","lessThan":"6.16","versionType":"semver","status":"affected"},{"version":"6.16.1","lessThan":"6.17","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/powerpc/kernel/eeh_driver.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/102e3dc5ab5ba052e294819e83384166b242c1ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/24524fca27da674668941440e8e05cdfec0b0222","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2920af33d097ca335e492b346af70b72986ad6dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3833dfae0680b6b16e2469fbc90aa48376311cd8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/460fab22b65138531082910702f74b048b25237b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/85d8eaefc052cf3e5ae2c7bafeda2db68b8898b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a58531181363219fa5de2b53d5d7274dcdfca98b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c5e68706527968282e49de205cc2b935823cb88a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97949","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:22.453","lastModified":"2026-10-21T13:21:17.213","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: unhash the dentry before dropping the item in rmdir\n\nconfigfs_get_config_item() treats a hashed dentry as proof that\nsd->s_element is a live config_item.  configfs_rmdir() breaks that:\nsimple_rmdir() leaves the dentry hashed, the last reference to the item is\ndropped right after, and the dentry is only unhashed by d_delete() once\n->rmdir() has returned.  configfs_symlink() resolves its target holding no\nlock on it, so get_target() can land in that window:\n\n  BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90\n   get_target fs/configfs/symlink.c:128 [inline]\n   configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185\n\nUnhash in configfs_remove_dir(), while the item is still guaranteed to be\nthere.  A reference obtained just before that stays harmless, as\ncreate_link() rechecks CONFIGFS_USET_DROPPING, already set by\nconfigfs_detach_prep().  Both configfs_unregister_subsystem() paths\nd_drop() after detaching, so this only makes rmdir match them."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/configfs/dir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7063fbf2261194f72ee75afca67b3b38b554b5fa","lessThan":"b315d865660766d45ecdbf7433a4e3d36a554b3b","versionType":"git","status":"affected"},{"version":"7063fbf2261194f72ee75afca67b3b38b554b5fa","lessThan":"446720051d44eebaa81b33969173160057b73a33","versionType":"git","status":"affected"},{"version":"7063fbf2261194f72ee75afca67b3b38b554b5fa","lessThan":"5d7cbfb65e47cc71d5d94d87d5d0d1679080f3eb","versionType":"git","status":"affected"},{"version":"7063fbf2261194f72ee75afca67b3b38b554b5fa","lessThan":"925d8564f1b2d9b46c5ab63b9bc942cea006da9b","versionType":"git","status":"affected"},{"version":"7063fbf2261194f72ee75afca67b3b38b554b5fa","lessThan":"f06c2d26d1999d37e93299db0ecead04ca7d0b9f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/configfs/dir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.16","status":"affected"},{"version":"0","lessThan":"2.6.16","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/446720051d44eebaa81b33969173160057b73a33","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d7cbfb65e47cc71d5d94d87d5d0d1679080f3eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/925d8564f1b2d9b46c5ab63b9bc942cea006da9b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b315d865660766d45ecdbf7433a4e3d36a554b3b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f06c2d26d1999d37e93299db0ecead04ca7d0b9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97950","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:22.567","lastModified":"2026-10-21T13:21:17.320","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: pin the symlink target's dirent instead of chasing ->ci_dentry\n\ncreate_link() reads the target's configfs_dirent from\nitem->ci_dentry->d_fsdata, relying on the item reference taken by\nget_target().  That reference pins the item, not its dentry: the dentry is\npinned by DCACHE_PERSISTENT, which configfs_remove_dir() releases via\nsimple_rmdir() while the item is still alive.  A symlink racing with rmdir\nof its target can therefore find ->ci_dentry freed and its dirent\nreleased, triggering WARN_ON(!atomic_read(&sd->s_count)) in configfs_get().\n\nTake the dirent in get_target() as well, under ->d_lock and atomically\nwith the item reference, and pass it down to create_link().  A hashed\ndentry has not been killed yet, so its ->d_fsdata reference keeps the\ndirent alive there."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/configfs/symlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7063fbf2261194f72ee75afca67b3b38b554b5fa","lessThan":"a44744454eafbc158e8c8e3ef8d207076410b195","versionType":"git","status":"affected"},{"version":"7063fbf2261194f72ee75afca67b3b38b554b5fa","lessThan":"846ff40fd57a47e59a41f4e331ec3b34efaddc23","versionType":"git","status":"affected"},{"version":"7063fbf2261194f72ee75afca67b3b38b554b5fa","lessThan":"4f54beb2e7f6d399396466682fba3539bcdcb414","versionType":"git","status":"affected"},{"version":"7063fbf2261194f72ee75afca67b3b38b554b5fa","lessThan":"d47c5de1cd6bfbe1067fc310bf90e4e00205e839","versionType":"git","status":"affected"},{"version":"7063fbf2261194f72ee75afca67b3b38b554b5fa","lessThan":"a7c1290eef60711c10289c056ad32ed1f2b47b12","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/configfs/symlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.16","status":"affected"},{"version":"0","lessThan":"2.6.16","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4f54beb2e7f6d399396466682fba3539bcdcb414","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/846ff40fd57a47e59a41f4e331ec3b34efaddc23","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a44744454eafbc158e8c8e3ef8d207076410b195","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a7c1290eef60711c10289c056ad32ed1f2b47b12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d47c5de1cd6bfbe1067fc310bf90e4e00205e839","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97951","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:22.673","lastModified":"2026-10-19T10:17:46.330","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands\n\nWhen a LUN_RESET aborts a WRITE command that is in the\nTRANSPORT_WRITE_PENDING state, the target core sets CMD_T_ABORTED and\nwaits for the frontend to finish processing.\n\nIf the initiator subsequently sends the remaining dataout PDUs,\n__iscsit_check_dataout_hdr() catches the payload, stops the dataout\ntimer if the sequence is final and finally dumps the data.  However, the\niSCSI target doesn't trigger the completion process for these aborted\ncommands. Because of this, the abort path hangs indefinitely in\ntarget_put_cmd_and_wait(), leading to a deadlocked target worker thread.\n\nFix this by explicitly calling target_complete_cmd() when the final\ndataout PDU is received for an aborted WRITE command.\ntarget_complete_cmd() detects the CMD_T_ABORTED flag and cleanly routes\nthe command into target_abort_work, allowing the abort completion to\nsuccessfully unblock."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/target/iscsi/iscsi_target.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2c9fa49e100f962af988f1c0529231bf14905cda","lessThan":"b070c8b4b237d55bdac13da3c5a994491177b312","versionType":"git","status":"affected"},{"version":"2c9fa49e100f962af988f1c0529231bf14905cda","lessThan":"19315262991dc983cc5c5c2ed24ff768abbf9339","versionType":"git","status":"affected"},{"version":"2c9fa49e100f962af988f1c0529231bf14905cda","lessThan":"f806f54ae3de780b8f4139baefc95b81c599cf9f","versionType":"git","status":"affected"},{"version":"2c9fa49e100f962af988f1c0529231bf14905cda","lessThan":"9c777f8e0cb0486fdf16db8ffea32e562a31e85b","versionType":"git","status":"affected"},{"version":"2c9fa49e100f962af988f1c0529231bf14905cda","lessThan":"638cf7c0cf64d5bb5704c3a78b54ae6602f69a32","versionType":"git","status":"affected"},{"version":"2c9fa49e100f962af988f1c0529231bf14905cda","lessThan":"f6f6351e98c77c27b51763ef52deb2efe4b46ac7","versionType":"git","status":"affected"},{"version":"2c9fa49e100f962af988f1c0529231bf14905cda","lessThan":"37f7f54d06c6100511979d6e9c1222b404e3f006","versionType":"git","status":"affected"},{"version":"2c9fa49e100f962af988f1c0529231bf14905cda","lessThan":"d5869dae5080e976d4b03cc33eb7ceb527f242bf","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/target/iscsi/iscsi_target.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/19315262991dc983cc5c5c2ed24ff768abbf9339","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/37f7f54d06c6100511979d6e9c1222b404e3f006","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/638cf7c0cf64d5bb5704c3a78b54ae6602f69a32","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c777f8e0cb0486fdf16db8ffea32e562a31e85b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b070c8b4b237d55bdac13da3c5a994491177b312","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5869dae5080e976d4b03cc33eb7ceb527f242bf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f6f6351e98c77c27b51763ef52deb2efe4b46ac7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f806f54ae3de780b8f4139baefc95b81c599cf9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97952","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:22.790","lastModified":"2026-10-19T10:17:46.440","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsunvdc: unmap LDC cookies when the descriptor send fails\n\n__send_request() maps the request's pages into the LDC channel's map\ntable (ldc_map_sg()), fills in the descriptor and marks it\nVIO_DESC_READY before ringing the doorbell via __vdc_tx_trigger().\nWhen the trigger fails, the error path only prints a message: the\ndescriptor stays READY and the cookies are never unmapped. The\nmapping is normally released in vdc_end_one() when the peer completes\nthe descriptor - but a descriptor whose doorbell was never sent will\nnever complete, and since dr->prod is not advanced on failure, the\nreset path (vdc_requeue_inflight(), which walks [cons, prod)) never\nvisits it either. The map table entries are leaked permanently.\n\nSince commit a11f6ca9aef9 (\"sunvdc: Do not spin in an infinite loop\nwhen vio_ldc_send() returns EAGAIN\") trigger failures occur in\npractice under load, so every resulting I/O error also leaks one\nrequest's worth of entries from the fixed-size (8192 entries per\nchannel) map table. Because the allocator hands out contiguous\nranges, fragmentation makes large multi-segment requests fail first\nas the table drains, until ldc_map_sg() fails permanently and the\ndisk is dead until reboot.\n\nIt also makes any retry-based recovery unusable: requeuing the\nrequest on -EAGAIN remaps the pages on every attempt, overwriting\ndesc->cookies and orphaning the previous mapping, so the table\ndrains at the retry rate. This is the memory exhaustion observed\nwhen the requeue approach was first tested in October 2025.\n\nRoll back on failure: unmap the cookies, mark the descriptor FREE\nagain and clear the request entry. If the trigger failed with\n-ENOTCONN, __vdc_tx_trigger() has already reset the port, which\ntears down and reallocates both the dring and the LDC channel\nincluding its map table - nothing to roll back, and the stale\ndescriptor must not be touched."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/block/sunvdc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec","lessThan":"eb9c5f6747fe98b83c78cb5476a914e91d50e8e8","versionType":"git","status":"affected"},{"version":"a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec","lessThan":"24564576be423f3b5d7e67cd7df848ac66646497","versionType":"git","status":"affected"},{"version":"a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec","lessThan":"9251573e7cf7d797ae4a30b2a236af8242237a61","versionType":"git","status":"affected"},{"version":"a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec","lessThan":"b0de6463667e9bb9dc14a83a9c24c1b6b3f7b5f7","versionType":"git","status":"affected"},{"version":"a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec","lessThan":"ab81a5c1014a38dab0fb402609fd866b0bcb4726","versionType":"git","status":"affected"},{"version":"a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec","lessThan":"57835952566f0be9b365a6eb3a70b397a9d5ef47","versionType":"git","status":"affected"},{"version":"a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec","lessThan":"f3322baa3a8ac87730feae952c1146269d78e098","versionType":"git","status":"affected"},{"version":"a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec","lessThan":"0c6da21fa35e03fc74f09895433ccd6d4a9c3530","versionType":"git","status":"affected"},{"version":"627e656239c63d8a81672d08de7885e89c12fa75","versionType":"git","status":"affected"},{"version":"a1ef7d5da9b2c145f811a80bb8197df6037a7572","versionType":"git","status":"affected"},{"version":"7ab4b6526fdcdfa7772984bbcd2ac4fd14fa223b","versionType":"git","status":"affected"},{"version":"3fbba4e55051d01a72b56ea192064175924bf56a","versionType":"git","status":"affected"},{"version":"3e380fc2ae4d18210eec9c472b12e2b2544f7dc1","versionType":"git","status":"affected"},{"version":"4.4.175","lessThan":"4.5","versionType":"semver","status":"affected"},{"version":"4.9.156","lessThan":"4.10","versionType":"semver","status":"affected"},{"version":"4.14.99","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.21","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"4.20.8","lessThan":"4.21","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/block/sunvdc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0c6da21fa35e03fc74f09895433ccd6d4a9c3530","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/24564576be423f3b5d7e67cd7df848ac66646497","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57835952566f0be9b365a6eb3a70b397a9d5ef47","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9251573e7cf7d797ae4a30b2a236af8242237a61","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab81a5c1014a38dab0fb402609fd866b0bcb4726","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0de6463667e9bb9dc14a83a9c24c1b6b3f7b5f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb9c5f6747fe98b83c78cb5476a914e91d50e8e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f3322baa3a8ac87730feae952c1146269d78e098","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97953","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:22.930","lastModified":"2026-10-21T13:21:17.420","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix TX descriptor availability check for TSO traffic\n\nstmmac_tso_xmit() estimates the number of free TX descriptors required by\na TSO skb as:\n\n\t(skb->len - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1\n\nwhich assumes the payload is split into TSO_MAX_BUFF_SIZE chunks. This\nunderestimates the descriptors actually consumed by stmmac_tso_allocator(),\nsince each fragment is mapped individually and so it needs at least one\ndescriptor regardless of its size. Moreover, one descriptor is used for\nthe L2/L3/L4 headers and, when the MSS changes, one more is consumed for\nthe MSS context descriptor.\nFor a highly fragmented TSO skb the check can therefore pass even when the\nring has too few free slots. stmmac_tso_allocator() then writes past the\navailable descriptors, overwriting descriptors still owned by the DMA\nengine, corrupting the TX ring.\nAdd stmmac_tso_get_num_desc() to compute the exact number of descriptors\nneeded for the header, the linear payload and each fragment, plus the MSS\ncontext descriptor when required, and use it in the availability check."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f748be531d7012c456b97f66091d86b3675c5fef","lessThan":"09c30547da2c45bb79f7d3adffc860af332c2d42","versionType":"git","status":"affected"},{"version":"f748be531d7012c456b97f66091d86b3675c5fef","lessThan":"ffa6d2481bc1c87f822ecd626561484e4ee24cef","versionType":"git","status":"affected"},{"version":"f748be531d7012c456b97f66091d86b3675c5fef","lessThan":"c28175220f808c867d5618de8ecc6dbcc815c773","versionType":"git","status":"affected"},{"version":"f748be531d7012c456b97f66091d86b3675c5fef","lessThan":"65820fc743eae322f7f94f6a64d07861211d4b21","versionType":"git","status":"affected"},{"version":"f748be531d7012c456b97f66091d86b3675c5fef","lessThan":"5e38d732ec67a5b1f9a56e6c73add480c4b6030a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":4.7}]},"references":[{"url":"https://git.kernel.org/stable/c/09c30547da2c45bb79f7d3adffc860af332c2d42","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5e38d732ec67a5b1f9a56e6c73add480c4b6030a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65820fc743eae322f7f94f6a64d07861211d4b21","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c28175220f808c867d5618de8ecc6dbcc815c773","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ffa6d2481bc1c87f822ecd626561484e4ee24cef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97954","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:23.040","lastModified":"2026-10-19T10:17:46.700","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: fix tcp stream corruption with large pages\n\nrds_message_map_pages() assigns PAGE_SIZE bytes to every\nscatterlist entry, even when total_len ends in a partial page. The RDS\ncongestion map is defined as 8192 bytes, so on systems with PAGE_SIZE\ngreater than 8192 the scatterlist maps bytes beyond the end of the\ncongestion map.  RDS-TCP transmits the SG contents according to those\nlengths, so the extra bytes become part of the TCP RDS stream and are\ninterpreted as subsequent RDS message headers, corrupting the stream.\n\nLimit the final scatterlist mapping to the number of bytes remaining.\nThis has no effect on systems with a 4K page size and allows RDS-TCP to\nbe used on systems with 16K and larger page sizes.\n\nThe RDS selftest, which previously hung on 16K pages, now passes."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/rds/message.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7875e18e09961d29f30424c5e2e48e704dc3789b","lessThan":"7d7705ce73eac1de1146706d887bc969a48ebb6d","versionType":"git","status":"affected"},{"version":"7875e18e09961d29f30424c5e2e48e704dc3789b","lessThan":"3230961a72b312d0e47101d1428084d0a02bff52","versionType":"git","status":"affected"},{"version":"7875e18e09961d29f30424c5e2e48e704dc3789b","lessThan":"ee74a4b42e3a2f9635ba376be9e58311322eebe4","versionType":"git","status":"affected"},{"version":"7875e18e09961d29f30424c5e2e48e704dc3789b","lessThan":"348492de88bc6ea06b6f3dd544a7a00d908a807b","versionType":"git","status":"affected"},{"version":"7875e18e09961d29f30424c5e2e48e704dc3789b","lessThan":"ef3565a418b8309589fe9b5df098a892c9146b06","versionType":"git","status":"affected"},{"version":"7875e18e09961d29f30424c5e2e48e704dc3789b","lessThan":"8cbfeb54bf781d9693778aaba133bb58c0285332","versionType":"git","status":"affected"},{"version":"7875e18e09961d29f30424c5e2e48e704dc3789b","lessThan":"f4649a716be20ef9272f97a166dea1825ba5b554","versionType":"git","status":"affected"},{"version":"7875e18e09961d29f30424c5e2e48e704dc3789b","lessThan":"2ac09b5353fe6858411fdc8c6efa60d832e20f13","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/rds/message.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","lessThan":"2.6.30","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2ac09b5353fe6858411fdc8c6efa60d832e20f13","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3230961a72b312d0e47101d1428084d0a02bff52","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/348492de88bc6ea06b6f3dd544a7a00d908a807b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d7705ce73eac1de1146706d887bc969a48ebb6d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8cbfeb54bf781d9693778aaba133bb58c0285332","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee74a4b42e3a2f9635ba376be9e58311322eebe4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ef3565a418b8309589fe9b5df098a892c9146b06","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f4649a716be20ef9272f97a166dea1825ba5b554","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97955","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:23.147","lastModified":"2026-10-19T10:17:46.807","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: restore the XDP program pointer when pre-allocation fails\n\nmana_xdp_set() publishes the new program into apc->bpf_prog before it\nallocates anything, because mana_pre_alloc_rxbufs() sizes the buffers\nfrom it via mana_get_rxbuf_cfg(). When that allocation fails the\nfunction returns the error directly, skipping the err_dealloc_rxbuffs\nlabel which is the only place that restores the previous pointer.\n\nThe attach is reported as failed, so the BPF core drops the reference it\nheld for the caller and the program can be freed, while apc->bpf_prog\nstill points at it. The next consumer of mana_xdp_get() - typically\nmana_chn_setxdp() from mana_alloc_queues() on the following ifup, or\nafter a TX timeout reset - then calls bpf_prog_add() on freed memory.\n\nThis is reachable from an ordinary \"ip link set dev ethX xdp obj ...\"\nwhenever the per-queue RX buffer pre-allocation cannot be satisfied.\n\nRestore the previous program on that error path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/microsoft/mana/mana_bpf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"730ff06d3f5cc2ce0348414b78c10528b767d4a3","lessThan":"5b3cdc9abd82b7e49e0f1a21d6eb75466c5ecef8","versionType":"git","status":"affected"},{"version":"730ff06d3f5cc2ce0348414b78c10528b767d4a3","lessThan":"9801edfba8dfcdb1da3b0afccdf143e13d646b56","versionType":"git","status":"affected"},{"version":"730ff06d3f5cc2ce0348414b78c10528b767d4a3","lessThan":"4c46beb807efcc93f5899ebe1f5958248eb296c6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/microsoft/mana/mana_bpf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4c46beb807efcc93f5899ebe1f5958248eb296c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5b3cdc9abd82b7e49e0f1a21d6eb75466c5ecef8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9801edfba8dfcdb1da3b0afccdf143e13d646b56","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97956","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:23.253","lastModified":"2026-10-19T10:17:46.893","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: net_failover: Fix the deadlock in net_failover_slave_name_change()\n\nThis is a sibling fix of commit\nb84c5632c7b3 (\"net: net_failover: Fix the deadlock in slave register\").\nThere is netdev_lock_ops() in the upper callers, so using netif_open()\ninstead of dev_open().\n\nCall Trace:\n __schedule+0x2bb/0x650\n schedule+0x27/0xb0\n schedule_preempt_disabled+0x15/0x30\n __mutex_lock.constprop.0+0x550/0xaf0\n __mutex_lock_slowpath+0x13/0x20\n mutex_lock+0x3b/0x50\n dev_open+0x3b/0xe0\n net_failover_slave_name_change+0x22/0x40\n failover_event+0xd4/0x1e0\n notifier_call_chain+0x62/0xf0\n raw_notifier_call_chain+0x16/0x30\n call_netdevice_notifiers_info+0x50/0x80\n netif_change_name+0x200/0x330\n do_setlink.isra.0+0xb12/0xdf0\n ? security_capable+0x9a/0x1e0\n ? ns_capable+0x31/0x60\n rtnl_setlink+0x302/0x670\n ? netlink_recvmsg+0x296/0x340\n ? security_capable+0x9a/0x1e0\n ? __pfx_rtnl_setlink+0x10/0x10\n rtnetlink_rcv_msg+0x384/0x460\n ? __pfx_rtnetlink_rcv_msg+0x10/0x10\n netlink_rcv_skb+0x61/0x120\n rtnetlink_rcv+0x15/0x30\n netlink_unicast+0x28f/0x3c0\n netlink_sendmsg+0x216/0x450\n __sys_sendto+0x222/0x230\n __x64_sys_sendto+0x24/0x40\n x64_sys_call+0x1d5d/0x2390\n do_syscall_64+0x105/0x5a0\n ? do_syscall_64+0x140/0x5a0\n ? exc_page_fault+0x94/0x1e0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/net_failover.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7e4d784f5810bba76c4593791028e13cce4af547","lessThan":"4b20e66d2e52d3628db4dccc1a33f134e73375d5","versionType":"git","status":"affected"},{"version":"7e4d784f5810bba76c4593791028e13cce4af547","lessThan":"c49bfa2c5dbd89f7683c26fc08b11e7369ea11e5","versionType":"git","status":"affected"},{"version":"7e4d784f5810bba76c4593791028e13cce4af547","lessThan":"985a663bf00799c1daf1c5789efa6406958780c8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/net_failover.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4b20e66d2e52d3628db4dccc1a33f134e73375d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/985a663bf00799c1daf1c5789efa6406958780c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c49bfa2c5dbd89f7683c26fc08b11e7369ea11e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97957","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:23.367","lastModified":"2026-10-19T10:17:46.987","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hinic: fix mailbox segment buffer overflow\n\ncheck_mbox_seq_id_and_seg_len() validates that seq_id does not\nexceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed\nMBOX_SEG_LEN (48).  However, this allows the last segment\n(seq_id=42) to carry a full 48-byte payload, writing to offset\n42*48=2016 for 48 bytes (ending at byte 2064).  The receive\nbuffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a\n16-byte heap buffer overflow.\n\nThe hinic3 driver already handles this correctly by defining\nMBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it\nexceeds the remaining buffer space.  Apply the same fix to the\nhinic driver."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c","lessThan":"7cc974799fde846eda2d8f00ad4f8e1810eb0499","versionType":"git","status":"affected"},{"version":"a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c","lessThan":"8de1e23bd91fe3a6683e4bc574e2d6bcb0eef920","versionType":"git","status":"affected"},{"version":"a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c","lessThan":"72be1fd5d256dde748c0905c5e1749a119cad5bd","versionType":"git","status":"affected"},{"version":"a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c","lessThan":"c622bbc212207d7c6bbd69dd88f0c3a3f5853d16","versionType":"git","status":"affected"},{"version":"a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c","lessThan":"eca54a092d5f7b497b458ff5a6f66d4f7bfb6674","versionType":"git","status":"affected"},{"version":"a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c","lessThan":"9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5","versionType":"git","status":"affected"},{"version":"a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c","lessThan":"513f7b16ed0cffae9348151c72bed17c7073096f","versionType":"git","status":"affected"},{"version":"a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c","lessThan":"5d4d985957434867bbe85e4fa5e638f3e48ad522","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/513f7b16ed0cffae9348151c72bed17c7073096f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d4d985957434867bbe85e4fa5e638f3e48ad522","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72be1fd5d256dde748c0905c5e1749a119cad5bd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cc974799fde846eda2d8f00ad4f8e1810eb0499","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8de1e23bd91fe3a6683e4bc574e2d6bcb0eef920","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c622bbc212207d7c6bbd69dd88f0c3a3f5853d16","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eca54a092d5f7b497b458ff5a6f66d4f7bfb6674","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97958","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:23.477","lastModified":"2026-10-19T10:17:47.123","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().\n\nIf a netlink socket sends RTM_GETCHAIN requests repeatedly\nwithout recv()ing the responses, tc_ctl_chain() hogs CPU and\ntriggers Hung Task splat. [0]\n\nAs caught in the stack trace, netlink_attachskb() could confuse\ntc_ctl_chain() by returning -EAGAIN when the userspace netlink\nsocket's receive buffer is full.\n\nThe replay: label exists since commit 32a4f5ecd738 (\"net: sched:\nintroduce chain object to uapi\") but was not used initially.\n\nSince commit 9f407f1768d3 (\"net: sched: introduce chain templates\"),\nthe label is needed for RTM_NEWCHAIN because tcf_proto_lookup_ops()\nmay release RTNL to call request_module().\n\nHowever, the replay logic is unnecessary for RTM_GETCHAIN.\n\nLet's apply the replay logic only for RTM_NEWCHAIN.\n\n[0]:\nINFO: task repro:1018 is blocked on a mutex likely owned by task repro:1022.\ntask:repro           state:R  running task     stack:14096 pid:1022  tgid:1014  ppid:961    task_flags:0x400040 flags:0x00080000\nCall Trace:\n <TASK>\n ? clockevents_program_event (kernel/time/clockevents.c:372)\n ? pskb_expand_head (net/core/skbuff.c:615)\n ? skb_release_data (net/core/skbuff.c:1122)\n ? netlink_attachskb (./include/linux/skbuff.h:1323 ./include/linux/skbuff.h:1332 net/netlink/af_netlink.c:1232)\n ? __netlink_lookup (./include/linux/rcupdate.h:882 ./include/linux/rhashtable.h:711 net/netlink/af_netlink.c:499)\n ? tc_chain_notify (net/sched/cls_api.c:3045)\n ? tc_chain_notify (./include/linux/skbuff.h:1384 net/sched/cls_api.c:3041)\n ? netlink_unicast (net/netlink/af_netlink.c:1335)\n ? rtnl_unicast (./include/net/netlink.h:1198 net/core/rtnetlink.c:985)\n ? tc_ctl_chain (net/sched/cls_api.c:3242)\n ? rtnetlink_rcv_msg (net/core/rtnetlink.c:7146)\n ? netlink_unicast (net/netlink/af_netlink.c:1354)\n ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:7177)\n ? netlink_rcv_skb (net/netlink/af_netlink.c:2556)\n ? netlink_unicast (net/netlink/af_netlink.c:1319)\n ? netlink_sendmsg (net/netlink/af_netlink.c:1900)\n ? __sock_sendmsg (net/socket.c:800)\n ? __sys_sendto (net/socket.c:2281)\n ? __x64_sys_sendto (net/socket.c:2288 net/socket.c:2284 net/socket.c:2284)\n ? do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)\n ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n </TASK>"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sched/cls_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2ed9db3074fcd8d12709fe40ff0e691d74229818","lessThan":"240251a4ca7cda213103694b6e21c4a5745e5d8b","versionType":"git","status":"affected"},{"version":"2ed9db3074fcd8d12709fe40ff0e691d74229818","lessThan":"9a0f07f7dbd1bfe8c2fd03ad055e9e60a703d5df","versionType":"git","status":"affected"},{"version":"2ed9db3074fcd8d12709fe40ff0e691d74229818","lessThan":"6558b0d46c5941ed1aa67da8878e224c54239cc5","versionType":"git","status":"affected"},{"version":"2ed9db3074fcd8d12709fe40ff0e691d74229818","lessThan":"96c2fc5daf983af2e0c1256c31e89c1f3f855279","versionType":"git","status":"affected"},{"version":"2ed9db3074fcd8d12709fe40ff0e691d74229818","lessThan":"a1c2840d95af1fa3d83ba71e23fa0c674a4c6796","versionType":"git","status":"affected"},{"version":"2ed9db3074fcd8d12709fe40ff0e691d74229818","lessThan":"503ba58481e3ba69d28127d35a39cec529f9670c","versionType":"git","status":"affected"},{"version":"2ed9db3074fcd8d12709fe40ff0e691d74229818","lessThan":"e9ac395bb56122a057d0aa91a6b55d9e3fa37c26","versionType":"git","status":"affected"},{"version":"2ed9db3074fcd8d12709fe40ff0e691d74229818","lessThan":"dff39930ad5e53d202bfdfb14687d1d2fd753b4d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sched/cls_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/240251a4ca7cda213103694b6e21c4a5745e5d8b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/503ba58481e3ba69d28127d35a39cec529f9670c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6558b0d46c5941ed1aa67da8878e224c54239cc5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96c2fc5daf983af2e0c1256c31e89c1f3f855279","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a0f07f7dbd1bfe8c2fd03ad055e9e60a703d5df","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a1c2840d95af1fa3d83ba71e23fa0c674a4c6796","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dff39930ad5e53d202bfdfb14687d1d2fd753b4d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9ac395bb56122a057d0aa91a6b55d9e3fa37c26","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97959","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:23.600","lastModified":"2026-10-19T10:17:47.253","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_route: free emptied bucket on filter move\n\nroute4_change can move an existing filter to a different top-level\nbucket: route4_set_parms recomputes the handle from TCA_ROUTE4_TO/\nFROM/IIF, and the handle-mismatch check is gated on the 'new' flag, so\nfor an existing filter the new handle may differ from the old one and\nland in a different bucket. When this happens, the filter is unlinked\nfrom the old bucket, but the bucket itself is never freed once it goes\nempty. The stale empty bucket remains in head->table[], causing\nroute4_delete to report *last=false even after the last live filter is\ngone. That pins the empty tcf_proto and causes a leak.\n\nFix this by refcounting the filters linked to a bucket and freeing the\nbucket when the count drops to zero. The existing scan in route4_delete\ngoes away with it.\n\nThe count is updated at all sites that link or unlink a filter during add,\nchange and delete, and the bucket is dropped from head->table[] as soon as\nit reaches zero.\n\nConditions to recreate the bug:\n  CONFIG_NET_CLS_ROUTE4=y, CONFIG_NET_SCH_INGRESS=y, CONFIG_NET_CLS_ACT=y.\n\n  tc qdisc replace dev lo clsact\n  tc filter add dev lo ingress protocol ip pref 100 route from 1 to 1\n  tc filter change dev lo ingress protocol ip pref 100 handle 0x10001 \\\n    route from 1 to 2\n  tc filter del dev lo ingress protocol ip pref 100 handle 0x10002 \\\n    route from 1 to 2\n  tc filter show dev lo ingress | grep -c 'pref 100 route chain 0 '"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sched/cls_route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1e052be69d045c8d0f82ff1116fd3e5a79661745","lessThan":"9e7741b41a25b9d49df4d262fa314342e6f95c50","versionType":"git","status":"affected"},{"version":"1e052be69d045c8d0f82ff1116fd3e5a79661745","lessThan":"48d38bf8c22a05fde07ba1f885cde27b851649a2","versionType":"git","status":"affected"},{"version":"1e052be69d045c8d0f82ff1116fd3e5a79661745","lessThan":"cc99d26b12431e4e4d0e346ec32764eb42c0aed9","versionType":"git","status":"affected"},{"version":"1e052be69d045c8d0f82ff1116fd3e5a79661745","lessThan":"41e94079200aaf0cdbe4594b0af75710b33da124","versionType":"git","status":"affected"},{"version":"1e052be69d045c8d0f82ff1116fd3e5a79661745","lessThan":"2e2f130951d34871b0643bf700164d97cff4b427","versionType":"git","status":"affected"},{"version":"1e052be69d045c8d0f82ff1116fd3e5a79661745","lessThan":"f8495d67434e1cb7e511297687ca55fdb28e4c20","versionType":"git","status":"affected"},{"version":"1e052be69d045c8d0f82ff1116fd3e5a79661745","lessThan":"81dd117c04422c6d0c7974aba9fa6a0ba370959b","versionType":"git","status":"affected"},{"version":"1e052be69d045c8d0f82ff1116fd3e5a79661745","lessThan":"1853f30cf5c84971f99788a76207c6f745380896","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sched/cls_route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.1","status":"affected"},{"version":"0","lessThan":"4.1","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1853f30cf5c84971f99788a76207c6f745380896","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2e2f130951d34871b0643bf700164d97cff4b427","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41e94079200aaf0cdbe4594b0af75710b33da124","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/48d38bf8c22a05fde07ba1f885cde27b851649a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81dd117c04422c6d0c7974aba9fa6a0ba370959b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e7741b41a25b9d49df4d262fa314342e6f95c50","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc99d26b12431e4e4d0e346ec32764eb42c0aed9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8495d67434e1cb7e511297687ca55fdb28e4c20","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97960","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:23.720","lastModified":"2026-10-21T13:21:17.560","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel: Prevent drain_pebs() reentry\n\nThe PEBS buffer is shared by all events on a CPU, so drain_pebs() must\nnot be reentered. If so, one instance may observe stale buffer state and\npotentially access out-of-bound memory.\n\nMost invocations happen in NMI context, which naturally prevents reentry.\nHowever, drain_pebs() is also reachable from process context via\nintel_pmu_drain_pebs_buffer().\n\nIn those paths, the PMU is often already disabled, but not guaranteed.\nFor example, __intel_pmu_pebs_disable() only disables the target counter,\nso other active counters can still raise a PMI and interrupt an in-flight\ndrain_pebs(). Here is an example,\n\n__perf_addr_filters_adjust()\n  perf_event_stop()\n    __perf_event_stop()\n      x86_pmu_stop() (event->pmu->stop)\n        intel_pmu_disable_event()\n          intel_pmu_pebs_disable()\n            __intel_pmu_pebs_disable()\n              intel_pmu_drain_large_pebs()\n                intel_pmu_drain_pebs_buffer()\n\nIntroduce __intel_pmu_quiesce() and __intel_pmu_resume() helpers and\nuse them in intel_pmu_drain_large_pebs() to disable the full PMU\naround the intel_pmu_drain_pebs_buffer() call, preventing reentry.\n\nAlso add a warning in intel_pmu_drain_pebs_buffer() when the full PMU is\nnot disabled."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/events/intel/core.c","arch/x86/events/intel/ds.c","arch/x86/events/perf_event.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b752ea0c28e3f7f0aaaad6abf84f735eebc37a60","lessThan":"9882068ed242fcd4743f53027e8c790e88dcafff","versionType":"git","status":"affected"},{"version":"b752ea0c28e3f7f0aaaad6abf84f735eebc37a60","lessThan":"999e482fdf89400cc1ae937680fc05096b4c915b","versionType":"git","status":"affected"},{"version":"b752ea0c28e3f7f0aaaad6abf84f735eebc37a60","lessThan":"a5fe19dd8b3ed5fad6e5e0f0c58c7245043ee4af","versionType":"git","status":"affected"},{"version":"b752ea0c28e3f7f0aaaad6abf84f735eebc37a60","lessThan":"c55599c0ec2aa020e41a0599c3044c56d8a2e7d9","versionType":"git","status":"affected"},{"version":"b752ea0c28e3f7f0aaaad6abf84f735eebc37a60","lessThan":"a56c03a397e2cd0c4cf8da96dcd6214f7d0e7d8c","versionType":"git","status":"affected"},{"version":"a9165207b2b07415eeb01b3ac8bb84976ec96984","versionType":"git","status":"affected"},{"version":"6.3.7","lessThan":"6.4","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/events/intel/core.c","arch/x86/events/intel/ds.c","arch/x86/events/perf_event.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/9882068ed242fcd4743f53027e8c790e88dcafff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/999e482fdf89400cc1ae937680fc05096b4c915b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a56c03a397e2cd0c4cf8da96dcd6214f7d0e7d8c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a5fe19dd8b3ed5fad6e5e0f0c58c7245043ee4af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c55599c0ec2aa020e41a0599c3044c56d8a2e7d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97961","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:23.860","lastModified":"2026-10-21T13:21:17.717","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Allow list_del during perf_event_overflow()\n\nA PMU might use perf_sched_cb_inc() and perf_sched_cb_dec()\ninterface to get the PMU call back function pmu::sched_task\ninvoked at schedule in and schedule out. This is achieved\nby walking along the list anchored by sched_cb_list.\n\nThe following scenario might lead to a list corruption.\n\n   perf_pmu_sched_task()\n      for_each_list_entry(..., &sched_cb_list)\n      +--> __perf_pmu_sched_task()\n           +--> event->pmu->sched_task())\n                +--> PMU_push_sample()\n                     +--> perf_event_overflow()\n                          +--> __perf_event_overflow()\n                               +--> pmu->stop()\n                                    +--> perf_sched_cb_dec()\n                                         remove entry from sched_cb_list\n                                         while list node in use.\n\nThis happens when ioctl(fd, PERF_EVENT_IOC_REFRESH, xxx) has been\ninvoked and perf_event::event_limit hits zero.\n\nPrevent the list corruption and convert for_each_list_entry()\nto for_each_list_entry_safe()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bd27568117664b8b3e259721393df420ed51f57b","lessThan":"fa360a018369f3eb4fe4f4792238adfc1f6fd5dc","versionType":"git","status":"affected"},{"version":"bd27568117664b8b3e259721393df420ed51f57b","lessThan":"723e85fb2c3bcd237ac02cbd69502ed62ce0068c","versionType":"git","status":"affected"},{"version":"bd27568117664b8b3e259721393df420ed51f57b","lessThan":"6d0b9ce3be221c9077653f3670d60d66bb725ee2","versionType":"git","status":"affected"},{"version":"bd27568117664b8b3e259721393df420ed51f57b","lessThan":"e2770c76a02452fddb52e9e05c7ed6acfef06c32","versionType":"git","status":"affected"},{"version":"bd27568117664b8b3e259721393df420ed51f57b","lessThan":"59e63416f5153e7d58652c616fbdcb7d5e01fff7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/59e63416f5153e7d58652c616fbdcb7d5e01fff7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d0b9ce3be221c9077653f3670d60d66bb725ee2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/723e85fb2c3bcd237ac02cbd69502ed62ce0068c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2770c76a02452fddb52e9e05c7ed6acfef06c32","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fa360a018369f3eb4fe4f4792238adfc1f6fd5dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97962","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:23.970","lastModified":"2026-10-21T13:21:17.823","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Move representor vnic reporter to eswitch devlink port\n\nThe representor vnic devlink health reporter is created and destroyed\nalong the representor netdev (un)load path, which is not serialized by\nthe devlink instance lock. Destroying the reporter from there triggers\na devl_assert_locked() splat on driver unbind:\n  WARNING: net/devlink/core.c:259 at devl_assert_locked+0x54/0x70, CPU#2: bash/3758\n  Modules linked in: mlx5_vdpa vringh vdpa mlx5_ib mlx5_fwctl mlx5_core ...\n  CPU: 2 UID: 0 PID: 3758 Comm: bash Tainted: G        W           6.19.0+ #1 PREEMPT\n  Tainted: [W]=WARN\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), ...\n  RIP: 0010:devl_assert_locked+0x54/0x70\n  Call Trace:\n   <TASK>\n   devl_health_reporter_destroy+0x3a/0x1b0\n   mlx5e_vport_rep_unload+0x12d/0x2b0 [mlx5_core]\n   mlx5_eswitch_unregister_vport_reps+0x1b8/0x220 [mlx5_core]\n   ? __esw_offloads_unload_rep+0x190/0x190 [mlx5_core]\n   ? kernfs_remove_by_name_ns+0xc3/0xf0\n   device_release_driver_internal+0x3b2/0x560\n   unbind_store+0xce/0xf0\n\nMove the reporter's lifecycle to the eswitch devlink port (un)register\npaths, which are already serialized by the devlink instance lock, and\nstore the handle on mlx5_devlink_port. Use the port's mlx5_vport as the\nreporter priv since the diagnose callback only needs a device handle and\na vport number, and mlx5_vport carries both and is initialized before\nany representor driver probes."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/en_rep.c","drivers/net/ethernet/mellanox/mlx5/core/en_rep.h","drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c","drivers/net/ethernet/mellanox/mlx5/core/eswitch.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cf14af140a5ad0937d385ce693100f33f02e9c54","lessThan":"d552beb9d278aeb180d26c3889b6bd21444ad11e","versionType":"git","status":"affected"},{"version":"cf14af140a5ad0937d385ce693100f33f02e9c54","lessThan":"fb52d58f7d6abc2f956d9c1ac472c709f7bb33c2","versionType":"git","status":"affected"},{"version":"cf14af140a5ad0937d385ce693100f33f02e9c54","lessThan":"dcaba72c85c14fe7393a59d61695941e6ccbd7d7","versionType":"git","status":"affected"},{"version":"cf14af140a5ad0937d385ce693100f33f02e9c54","lessThan":"d1fcff9b39bac188ef62a77ebd176484be928ec2","versionType":"git","status":"affected"},{"version":"cf14af140a5ad0937d385ce693100f33f02e9c54","lessThan":"7f26a5e8040b4957ef4dbdfcde6cc7ba2db53937","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/en_rep.c","drivers/net/ethernet/mellanox/mlx5/core/en_rep.h","drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c","drivers/net/ethernet/mellanox/mlx5/core/eswitch.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/7f26a5e8040b4957ef4dbdfcde6cc7ba2db53937","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1fcff9b39bac188ef62a77ebd176484be928ec2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d552beb9d278aeb180d26c3889b6bd21444ad11e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dcaba72c85c14fe7393a59d61695941e6ccbd7d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fb52d58f7d6abc2f956d9c1ac472c709f7bb33c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97963","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:24.080","lastModified":"2026-10-19T10:17:47.687","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: initialize ptp_lock at probe time\n\npriv->ptp_lock is only initialized in stmmac_ptp_register(), which runs\nduring __stmmac_open(). However, the lock is also used while the\ninterface is down and has never been opened: tc_taprio_configure()\ninvokes the PTP gettime64() callback to compute the EST base time when\noffloading a TAPRIO schedule, and stmmac_get_time() takes\npriv->ptp_lock. Using an uninitialized rwlock is undefined behaviour.\nMove the rwlock_init() to __stmmac_dvr_probe(), together with the other\nprivate locks, so that ptp_lock is always valid regardless of the\ninterface state."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c","drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b60189e0392fa06348911077ef281eb2b1047b6a","lessThan":"ee33e424d4932c70f103b94a46b685923f236f65","versionType":"git","status":"affected"},{"version":"b60189e0392fa06348911077ef281eb2b1047b6a","lessThan":"7ced87834f3a58761d4bbcabf8326478548e6a54","versionType":"git","status":"affected"},{"version":"b60189e0392fa06348911077ef281eb2b1047b6a","lessThan":"79fb5bcc50996964e076dffbdc24b7d2c06bd957","versionType":"git","status":"affected"},{"version":"b60189e0392fa06348911077ef281eb2b1047b6a","lessThan":"420315413b29635de1d4ea4142e410e6465260f3","versionType":"git","status":"affected"},{"version":"b60189e0392fa06348911077ef281eb2b1047b6a","lessThan":"25cc0096efba83b4e0e6fa50f03e9543b41e9d3d","versionType":"git","status":"affected"},{"version":"b60189e0392fa06348911077ef281eb2b1047b6a","lessThan":"b1986595cf827c38ff929e22fbc9ca8f76379306","versionType":"git","status":"affected"},{"version":"b60189e0392fa06348911077ef281eb2b1047b6a","lessThan":"0338c68e22abd2ee509ec2e32508a50896618c32","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c","drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0338c68e22abd2ee509ec2e32508a50896618c32","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/25cc0096efba83b4e0e6fa50f03e9543b41e9d3d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/420315413b29635de1d4ea4142e410e6465260f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/79fb5bcc50996964e076dffbdc24b7d2c06bd957","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ced87834f3a58761d4bbcabf8326478548e6a54","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1986595cf827c38ff929e22fbc9ca8f76379306","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee33e424d4932c70f103b94a46b685923f236f65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97964","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:24.187","lastModified":"2026-10-19T10:17:47.790","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nppp_synctty: ensure a writeable skb header\n\nppp_sync_txmunge() checks headroom before prepending the address and\ncontrol bytes, but does not ensure that the skb header is writable.\nA received skb can reach this function through PPP channel bridging\nwithout passing through ppp_start_xmit(), which calls skb_cow_head().\n\nFor example, a PPPoE frame may share its buffer with a clone queued to\nan AF_PACKET socket. If it is bridged to a synchronous tty channel, the\naddress/control bytes can overwrite data still visible to that socket.\n\nUse skb_cow_head() to ensure both sufficient headroom and a writable\nheader."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ppp/ppp_synctty.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4cf476ced45d7f12df30a68e833b263e7a2202d1","lessThan":"25e03eeead2c49748c7582dfb64c205f93a42d00","versionType":"git","status":"affected"},{"version":"4cf476ced45d7f12df30a68e833b263e7a2202d1","lessThan":"a256f9925288ef47de8febed5c38d5cc21340211","versionType":"git","status":"affected"},{"version":"4cf476ced45d7f12df30a68e833b263e7a2202d1","lessThan":"7953946f68262a8bb137aa101249adef6e029652","versionType":"git","status":"affected"},{"version":"4cf476ced45d7f12df30a68e833b263e7a2202d1","lessThan":"3af7797fbabc84992e0ca5ad2bc0ca8537d053ef","versionType":"git","status":"affected"},{"version":"4cf476ced45d7f12df30a68e833b263e7a2202d1","lessThan":"0996c3e6bcc6ae08cb371ed43648c9f7f748ae6e","versionType":"git","status":"affected"},{"version":"4cf476ced45d7f12df30a68e833b263e7a2202d1","lessThan":"15d0a6c9a42df2d745c37510dba828f6dbe60d9f","versionType":"git","status":"affected"},{"version":"4cf476ced45d7f12df30a68e833b263e7a2202d1","lessThan":"8aaeb56aff2a557a88f83ae866da2c91ad247e59","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ppp/ppp_synctty.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0996c3e6bcc6ae08cb371ed43648c9f7f748ae6e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/15d0a6c9a42df2d745c37510dba828f6dbe60d9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/25e03eeead2c49748c7582dfb64c205f93a42d00","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3af7797fbabc84992e0ca5ad2bc0ca8537d053ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7953946f68262a8bb137aa101249adef6e029652","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8aaeb56aff2a557a88f83ae866da2c91ad247e59","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a256f9925288ef47de8febed5c38d5cc21340211","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97965","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:24.293","lastModified":"2026-10-21T13:21:17.963","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: initialize _md in vxlan_xmit_one()\n\nIf a VXLAN device is configured with both VXLAN_F_COLLECT_METADATA and\nVXLAN_F_GBP, and a packet is transmitted through it using an external\nip_tunnel_info that lacks the IP_TUNNEL_VXLAN_OPT_BIT flag, md is left\npointing to the uninitialized _md stack variable:\n\n                if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags)) {\n                        if (info->options_len < sizeof(*md))\n                                goto drop;\n                        md = ip_tunnel_info_opts(info);\n                }\n\nBecause IP_TUNNEL_VXLAN_OPT_BIT is not set, md is not updated and remains\npointing to _md. Later, vxlan_build_skb() is called with md, which\neventually calls vxlan_build_gbp_hdr():\n\n        if (vxflags & VXLAN_F_GBP)\n                vxlan_build_gbp_hdr(vxh, md);\n\nInside vxlan_build_gbp_hdr(), md->gbp is read:\n\n        if (!md->gbp)\n                return;\n        gbp = (struct vxlanhdr_gbp *)vxh;\n        ...\n        if (md->gbp & VXLAN_GBP_DONT_LEARN)\n                gbp->dont_learn = 1;\n\nIf the stack contains garbage, this causes:\n1) VXLAN_HF_GBP flag to be spuriously set in the VXLAN header.\n2) gbp->dont_learn and gbp->policy_applied to be set from stack bits.\n3) gbp->policy_id to receive 16 bits of uninitialized kernel stack data,\n   leaking it onto the wire.\n\nFix this by zero-initializing _md. If IP_TUNNEL_VXLAN_OPT_BIT is not\npresent, md->gbp remains 0, and vxlan_build_gbp_hdr() returns early\nwithout modifying the VXLAN header."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/vxlan/vxlan_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ee122c79d4227f6ec642157834b6a90fcffa4382","lessThan":"fb78beb64e0e79557e4cd7cd17fea744bb6f01d9","versionType":"git","status":"affected"},{"version":"ee122c79d4227f6ec642157834b6a90fcffa4382","lessThan":"0d13b5a413bffc8718b3821b78537ccc6596c233","versionType":"git","status":"affected"},{"version":"ee122c79d4227f6ec642157834b6a90fcffa4382","lessThan":"bfb74c48ac2d31476d5e09cf9658844508d2608a","versionType":"git","status":"affected"},{"version":"ee122c79d4227f6ec642157834b6a90fcffa4382","lessThan":"081f22177d9d12b1e381b787f203cd5f47508187","versionType":"git","status":"affected"},{"version":"ee122c79d4227f6ec642157834b6a90fcffa4382","lessThan":"be83178bfc44588f6e3adb827ed874c683193466","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/vxlan/vxlan_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.3","status":"affected"},{"version":"0","lessThan":"4.3","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/081f22177d9d12b1e381b787f203cd5f47508187","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0d13b5a413bffc8718b3821b78537ccc6596c233","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be83178bfc44588f6e3adb827ed874c683193466","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfb74c48ac2d31476d5e09cf9658844508d2608a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fb78beb64e0e79557e4cd7cd17fea744bb6f01d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97966","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:24.413","lastModified":"2026-10-19T10:17:48.000","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: reset HTB scheduler topology before freeing queues\n\nHTB offload programs NIX_AF_TLxX_TOPOLOGY on QoS-allocated scheduler\nqueues via otx2_qos_txschq_set_parent_topology(), but teardown freed\nthose queues without clearing TOPOLOGY.  The AF only restores PARENT and\nSCHEDULE on free, so PRIO_ANCHOR/RR_PRIO settings can survive in the\nshared scheduler pool and affect later allocations.\n\nAdd otx2_qos_reset_schq_topology() and otx2_qos_free_hw_schq() to zero\nTL4 through TL2 TOPOLOGY before each schq is returned to the AF during\nhierarchy teardown and cfg rollback.  Skip the aggregation level (TL1):\nit is a per-tx-link queue shared by the PF, default Tx hierarchy and VFs,\nand is not freed back to the AF by nix_txschq_free_one()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/marvell/octeontx2/nic/qos.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5e6808b4c68d7882971514ab3279926eb07c8b2d","lessThan":"16c5c8ea5017952ff14c87626a45359d195dda6f","versionType":"git","status":"affected"},{"version":"5e6808b4c68d7882971514ab3279926eb07c8b2d","lessThan":"0aa2dd6eaa347c7aab448df0eec0afcfe7489885","versionType":"git","status":"affected"},{"version":"5e6808b4c68d7882971514ab3279926eb07c8b2d","lessThan":"621c99be42e3f5cb68a6af9480a255218a761c4e","versionType":"git","status":"affected"},{"version":"5e6808b4c68d7882971514ab3279926eb07c8b2d","lessThan":"2df186418e17b30b319cf9ff81aad137692ab107","versionType":"git","status":"affected"},{"version":"5e6808b4c68d7882971514ab3279926eb07c8b2d","lessThan":"ef39fca8508597fa565cf2be72a884a712fb98af","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/marvell/octeontx2/nic/qos.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0aa2dd6eaa347c7aab448df0eec0afcfe7489885","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/16c5c8ea5017952ff14c87626a45359d195dda6f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2df186418e17b30b319cf9ff81aad137692ab107","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/621c99be42e3f5cb68a6af9480a255218a761c4e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ef39fca8508597fa565cf2be72a884a712fb98af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97967","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:24.523","lastModified":"2026-10-19T10:17:48.093","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (corsair-cpro) Remove debugfs entries when probe fails\n\nccp_debugfs_init() registers debugfs files whose private data is the devm\nallocated ccp.  If hwmon_device_register_with_info() fails right after it,\nccp_probe() returns without removing them: the HID core then frees ccp,\nand ccp_remove() is not called for a failed probe, so the files stay\nbehind.  Reading one of them dereferences the freed pointer.\n\nRemove the debugfs entries on that error path.  debugfs_remove_recursive()\nwaits for readers already inside the show callbacks, so ccp is no longer\nreachable through debugfs by the time probe returns."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/corsair-cpro.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5997eb60f896830126bc1783465b678b110e2fdd","lessThan":"ae01aafd8214e48cb7eff11e92dfbf3778d52d9d","versionType":"git","status":"affected"},{"version":"5997eb60f896830126bc1783465b678b110e2fdd","lessThan":"a5de53b08cc319dadce6fb68d33749ea37962952","versionType":"git","status":"affected"},{"version":"5997eb60f896830126bc1783465b678b110e2fdd","lessThan":"fdc1bc23ff59ee308042342cefcb918d6efba409","versionType":"git","status":"affected"},{"version":"5997eb60f896830126bc1783465b678b110e2fdd","lessThan":"4ee875c423c66c45d7ef7bbff403cd0e3971e0a2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/corsair-cpro.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4ee875c423c66c45d7ef7bbff403cd0e3971e0a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a5de53b08cc319dadce6fb68d33749ea37962952","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae01aafd8214e48cb7eff11e92dfbf3778d52d9d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fdc1bc23ff59ee308042342cefcb918d6efba409","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97968","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:24.633","lastModified":"2026-10-19T10:17:48.173","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (corsair-cpro) Create debugfs entries after hwmon registration\n\nccp_debugfs_init() registers debugfs files whose private data is the devm\nallocated ccp.  It runs before hwmon_device_register_with_info(), so when\nthat registration fails, ccp_probe() returns with the files still in\nplace.  The HID core then frees ccp, and ccp_remove() is not called for a\nfailed probe, so nothing removes them later either.  Reading one of the\nfiles dereferences the freed pointer.\n\nCreate the debugfs entries only after the hwmon device has been\nregistered, so no failing path can leave them behind.\n\nThe two version queries stay where they are.  They send USB commands\nwithout holding ccp->mutex, which is only safe as long as nothing else\ncan call send_usb_cmd(); once the hwmon device is registered its\ncallbacks can do so concurrently.  Only the debugfs creation moves, and\nit is told which queries succeeded."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/corsair-cpro.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5997eb60f896830126bc1783465b678b110e2fdd","lessThan":"6c5d333216a937044acd3336e9ec7e30ff2eaee4","versionType":"git","status":"affected"},{"version":"5997eb60f896830126bc1783465b678b110e2fdd","lessThan":"a58a966a440071bb877ef62535d1016952f83101","versionType":"git","status":"affected"},{"version":"5997eb60f896830126bc1783465b678b110e2fdd","lessThan":"fdfe17cb865715aad30328678344eb79889207ab","versionType":"git","status":"affected"},{"version":"5997eb60f896830126bc1783465b678b110e2fdd","lessThan":"508baf1713f32f287bfb4f85d759403ec8ba35a3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/corsair-cpro.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/508baf1713f32f287bfb4f85d759403ec8ba35a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6c5d333216a937044acd3336e9ec7e30ff2eaee4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a58a966a440071bb877ef62535d1016952f83101","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fdfe17cb865715aad30328678344eb79889207ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97969","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:24.767","lastModified":"2026-10-19T10:17:48.263","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: msc313e: Fix clock leak and spurious timer in settimeout()\n\nmsc313e_wdt_settimeout() unconditionally calls msc313e_wdt_start() which\nintroduces two severe bugs:\n\n1. If the watchdog is already active, calling start() again will\n   increase the reference count of the clock again.  However stop() is\n   only called once, the reference count is unbalance.\n2. If the watchdog is stopped, calling settimeout() will start\n   the hardware timer accidentally.\n\nFactor out the register-writing logic into a helper function.  Only call\nit in settimeout() if the watchdog is running.  Otherwise, simply update\n`wdev->timeout`."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/watchdog/msc313e_wdt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"68665016c7b777b44e27b6b0c1e6524c28ebe40a","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"77ef2aa8b46876ca9935f32dd874c517ccf5d880","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"a1dd0817776ea2a870ba2347001af13ddd4cb321","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"2152a13ee2a9af09a668ebd053a8dbf771dadb80","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"2abf99a57b0b71b2b97745981f4039370ab78044","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"faf1eb2895c87a8c0fb920439dddc7e0d97c6a69","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"3db30f315935c2fb0d95f46b7a593b5b4d3ec3d0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/watchdog/msc313e_wdt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2152a13ee2a9af09a668ebd053a8dbf771dadb80","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2abf99a57b0b71b2b97745981f4039370ab78044","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3db30f315935c2fb0d95f46b7a593b5b4d3ec3d0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68665016c7b777b44e27b6b0c1e6524c28ebe40a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/77ef2aa8b46876ca9935f32dd874c517ccf5d880","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a1dd0817776ea2a870ba2347001af13ddd4cb321","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/faf1eb2895c87a8c0fb920439dddc7e0d97c6a69","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97970","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:24.873","lastModified":"2026-10-19T10:17:48.373","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: msc313e: Avoid division by zero\n\nclk_get_rate() could return 0.  Avoid a division by zero panic."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/watchdog/msc313e_wdt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"5168267d5ae6f26f751512003df4263ae91ee3f0","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"db900bc7c0739e5505a84bebb1bff2c3f67860e3","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"660571b082331d250fbcef92363e15b38d107520","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"3ae8eb30f8a0a839bf36fa62e4201ac99946447f","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"47eae41c630b9d2ce16a528a1517d4d2f857cd47","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"5788a6747eda85051838628b40c430ec6343f3c6","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"3c73a37f5e40972ce26d8eeb98e8b938d719b069","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/watchdog/msc313e_wdt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3ae8eb30f8a0a839bf36fa62e4201ac99946447f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3c73a37f5e40972ce26d8eeb98e8b938d719b069","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/47eae41c630b9d2ce16a528a1517d4d2f857cd47","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5168267d5ae6f26f751512003df4263ae91ee3f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5788a6747eda85051838628b40c430ec6343f3c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/660571b082331d250fbcef92363e15b38d107520","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db900bc7c0739e5505a84bebb1bff2c3f67860e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97971","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:24.980","lastModified":"2026-10-19T10:17:48.477","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnstree: check listing permission before taking a namespace reference\n\nlegitimize_ns() takes a reference on the candidate namespace before\nmay_list_ns() has decided whether the caller may see it. The\n__free(ns_put) cleanup on the denied path can drop the last reference to a\nmount namespace while we still hold the rcu read lock, and put_mnt_ns()\nmay sleep there. This is the same problem commit 2ec2aff3c8e2 (\"ns: make\nsure reference are dropped outside of rcu lock\") fixed for the put_user()\npath. Neither ns_requested() nor may_list_ns() needs a reference, both\nonly look at the namespace type and at the caller's own namespaces, so do\nthe checks first and take the reference last.\n\nSplat:\n\n  Voluntary context switch within RCU read-side critical section!\n  WARNING: kernel/rcu/tree_plugin.h:332 at rcu_note_context_switch+0x238/0x2a0, CPU#5: a/3442\n  CPU: 5 UID: 1000 PID: 3442 Comm: a Not tainted 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy)\n  RIP: 0010:rcu_note_context_switch+0x238/0x2a0\n  Call Trace:\n   <TASK>\n   __schedule+0xcf/0x650\n   schedule+0x27/0x90\n   schedule_preempt_disabled+0x15/0x30\n   __mutex_lock.constprop.0+0x550/0xaf0\n   __mutex_lock_slowpath+0x13/0x20\n   mutex_lock+0x3b/0x50\n   exp_funnel_lock+0xb2/0x260\n   synchronize_rcu_expedited+0xe7/0x220\n   namespace_unlock+0x26a/0x320\n   put_mnt_ns+0xd3/0x120\n   mntns_put+0xe/0x20\n   do_listns+0x13e/0x560\n   __do_sys_listns+0x126/0x2d0\n   __x64_sys_listns+0x20/0x30\n   x64_sys_call+0x2366/0x2390\n   do_syscall_64+0x105/0x5a0\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   </TASK>"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/nstree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"76b6f5dfb3fda76fce1f9990d6fa58adc711122b","lessThan":"9e673bf5d88aa898e52cef5c87058c3fa845bc71","versionType":"git","status":"affected"},{"version":"76b6f5dfb3fda76fce1f9990d6fa58adc711122b","lessThan":"56ea4e86832d8abe8930394473566c194d189f85","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/nstree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/56ea4e86832d8abe8930394473566c194d189f85","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e673bf5d88aa898e52cef5c87058c3fa845bc71","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97972","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:25.090","lastModified":"2026-10-19T10:17:48.580","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: put the \"mdio\" child node reference on success\n\nmacb_mii_init() holds the reference returned by of_get_child_by_name()\nfor macb_mdiobus_register() and drops it only on the error paths, so\nevery successful probe leaks a node reference. On a CM5, overlay\nremoval after four bind cycles reports\n\n  OF: ERROR: memory leak, expected refcount 1 instead of 5\n\nDrop the reference after registration, where __mdiobus_register() has\nalready taken its own for the lifetime of the bus."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/cadence/macb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8a6631f1cece09047fa44608d21d520ca65ce7d8","lessThan":"5fba30080d298edb742396073372385c961578d3","versionType":"git","status":"affected"},{"version":"8a6631f1cece09047fa44608d21d520ca65ce7d8","lessThan":"7d60dc7ff85b73a2119d582ca2d4456b30960380","versionType":"git","status":"affected"},{"version":"8a6631f1cece09047fa44608d21d520ca65ce7d8","lessThan":"382a373d9ea7a6ac4de9c022385b6217f65ae3cc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/cadence/macb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/382a373d9ea7a6ac4de9c022385b6217f65ae3cc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5fba30080d298edb742396073372385c961578d3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d60dc7ff85b73a2119d582ca2d4456b30960380","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97973","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:25.203","lastModified":"2026-10-19T10:17:48.670","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: destroy the phylink instance on the probe error path\n\nmacb_mii_init() creates a phylink instance on both of its success paths,\nbut the probe unwind frees the netdev without destroying it, so a failing\nmacb_alloc_tieoff() or register_netdev() leaks the instance.\n\nDestroy it at err_out_unregister_mdio, which is only reachable once\nmacb_mii_init() has succeeded, so bp->phylink is valid there."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/cadence/macb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7897b071ac3b45a5788d084fc7f8a8ee9e5f07f0","lessThan":"0112aa02c7847314be599d68783d50c7e228a694","versionType":"git","status":"affected"},{"version":"7897b071ac3b45a5788d084fc7f8a8ee9e5f07f0","lessThan":"c1de1e7b51ab2531f564b39b51998c3d71caccd7","versionType":"git","status":"affected"},{"version":"7897b071ac3b45a5788d084fc7f8a8ee9e5f07f0","lessThan":"23b6a44ffea1c54a4232aa86ee470b21422a8cc5","versionType":"git","status":"affected"},{"version":"7897b071ac3b45a5788d084fc7f8a8ee9e5f07f0","lessThan":"e92a45b872b035c79acde8dd0da096a72b61ff2f","versionType":"git","status":"affected"},{"version":"7897b071ac3b45a5788d084fc7f8a8ee9e5f07f0","lessThan":"8558e3195664113c14a4d8fcf221b3caff41fed1","versionType":"git","status":"affected"},{"version":"7897b071ac3b45a5788d084fc7f8a8ee9e5f07f0","lessThan":"7d059f390750152b9bd69df934198651b94fc26d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/cadence/macb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.5","status":"affected"},{"version":"0","lessThan":"5.5","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0112aa02c7847314be599d68783d50c7e228a694","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/23b6a44ffea1c54a4232aa86ee470b21422a8cc5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d059f390750152b9bd69df934198651b94fc26d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8558e3195664113c14a4d8fcf221b3caff41fed1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c1de1e7b51ab2531f564b39b51998c3d71caccd7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e92a45b872b035c79acde8dd0da096a72b61ff2f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97974","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:25.310","lastModified":"2026-10-19T10:17:48.773","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()\n\nsyzbot reported a null-ptr-deref in __ip6_del_rt_siblings() [0].\n\nThe stack trace hinted towards a null dereference of rt->fib6_node when\nfn->leaf is accessed in __ip6_del_rt_siblings(). With\nRTNL_FLAG_DOIT_UNLOCKED set, inet6_rtm_delroute() operations run\nconcurrently without acquiring the RTNL lock. In ip6_route_del(), the\nroute lookup happens under rcu_read_lock() without acquiring\ntable->tb6_lock.\n\nBetween ip6_route_del() looking up the route and __ip6_del_rt_siblings()\nacquiring table->tb6_lock, another thread can modify the routing table.\nFor example, when an ECMP route is replaced via RTM_NEWROUTE with\nNLM_F_REPLACE, fib6_add_rt2node() unlinks all old siblings and sets\niter->fib6_node = NULL. A reproducer was found that triggers this [1].\n\nAdd a check to ensure rt->fib6_node is non-null before accessing it.\n\n[0]\nKASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]\nRIP: 0010:__ip6_del_rt_siblings+0x31e/0x7c0 net/ipv6/route.c:4056\nCall Trace:\n <TASK>\n ip6_route_del+0x1054/0x1110 net/ipv6/route.c:4232\n inet6_rtm_delroute+0x5d7/0x6d0 net/ipv6/route.c:5669\n rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132\n netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556\n netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345\n netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900\n sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800\n __sock_sendmsg net/socket.c:815 [inline]\n ____sys_sendmsg+0x565/0x870 net/socket.c:2713\n ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767\n __sys_sendmsg net/socket.c:2799 [inline]\n __do_sys_sendmsg net/socket.c:2804 [inline]\n __se_sys_sendmsg net/socket.c:2802 [inline]\n __x64_sys_sendmsg+0x1b7/0x290 net/socket.c:2802\n do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]\n do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\n[1] https://gist.github.com/NamanGulati/0766a1159b6ca61928faaf87425ff899"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bd11ff421d36abdb585b9104fa70057bf01b3110","lessThan":"e7ff91f19c1aae039a4257fa86fe849afe185291","versionType":"git","status":"affected"},{"version":"bd11ff421d36abdb585b9104fa70057bf01b3110","lessThan":"1155234c2227cf36072a43e1e09119472ade7ca7","versionType":"git","status":"affected"},{"version":"bd11ff421d36abdb585b9104fa70057bf01b3110","lessThan":"cdca92eddc025fdb90071be97738f7d55a65f8dd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1155234c2227cf36072a43e1e09119472ade7ca7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cdca92eddc025fdb90071be97738f7d55a65f8dd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7ff91f19c1aae039a4257fa86fe849afe185291","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97975","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:25.427","lastModified":"2026-10-21T13:21:18.100","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()\n\nA NULL pointer dereference in klist_put() occurs when a child device (such\nas a BNEP network device in bnep_session) is concurrently being\nunregistered while hci_conn_del_sysfs() reparents child devices.\n\nThis is caused by a race condition between hci_conn_del_sysfs() and\nconcurrent child device unregistration (e.g. bnep_session calling\nunregister_netdev()). During device unregistration, device_del() snapshots\na non-NULL parent pointer. Concurrently, hci_conn_del_sysfs() finds the\nchild device using device_find_any_child() and calls device_move() to\nreparent it to NULL, which removes the node from its parent's klist and\nclears knode_parent. Subsequently, device_del() calls\nklist_del(&dev->p->knode_parent) using the stale parent snapshot, causing\nklist_put() to dereference knode_klist(n)->put on an already removed node,\nresulting in a NULL pointer dereference.\n\nThis race was introduced by commit 27aabf27fd01 (\"Bluetooth: fix\nuse-after-free in device_for_each_child()\"), which replaced\ndevice_find_child(..., __match_tty) with device_find_any_child() in\nhci_conn_del_sysfs(). That change was intended to avoid a use-after-free\nwhere conn->dev outlived its parent hdev->dev when child devices held\nreferences to conn->dev, because conn->dev only held a reference to\nhdev->dev while registered in sysfs.\n\nFix the issue properly by taking an explicit reference to the parent device\nwith get_device(&hdev->dev) in hci_conn_init_sysfs() and dropping it with\nput_device(parent) in bt_link_release() when the conn device is freed. This\nensures that hdev->dev remains valid for the entire lifecycle of conn->dev,\nresolving the underlying use-after-free. With the parent reference held\nproperly, restore the __match_tty filter in hci_conn_del_sysfs() so that\ndevice_move() is only invoked on persistent RFCOMM TTY devices as\noriginally intended, eliminating the race condition with unregistering\nnetwork devices."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/hci_sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"de5a44f351ca7efd9add9851b218f5353e2224b7","lessThan":"55b76500546e5f2e7fdd7ae7283530b620de6e61","versionType":"git","status":"affected"},{"version":"7b277bd569bb6a2777f0014f84b4344f444fd49d","lessThan":"66cc55b69928b742d24b4c5b66d195ae96900e48","versionType":"git","status":"affected"},{"version":"27aabf27fd014ae037cc179c61b0bee7cff55b3d","lessThan":"eeabdb25c3209569367e99a85ca9a503b64a646d","versionType":"git","status":"affected"},{"version":"27aabf27fd014ae037cc179c61b0bee7cff55b3d","lessThan":"9e9ece97b8e716890793de261574b8efef7d8702","versionType":"git","status":"affected"},{"version":"27aabf27fd014ae037cc179c61b0bee7cff55b3d","lessThan":"9b851b09b392da68bd715601f10a5adb2d8d19b8","versionType":"git","status":"affected"},{"version":"6894717a1ea363c5a27010ba604f957c309d282d","versionType":"git","status":"affected"},{"version":"fb91ce37dc9a37ea23cf32b6d7b667004e93d4c5","versionType":"git","status":"affected"},{"version":"a9584c897d1cba6265c78010bbb45ca5722c88bc","versionType":"git","status":"affected"},{"version":"0f67ca2a80acf8b207240405b7f72d660665d3df","versionType":"git","status":"affected"},{"version":"91e2a2e4d1336333804cd31162984f01ad8cc70f","versionType":"git","status":"affected"},{"version":"6.6.64","lessThan":"6.6.160","versionType":"semver","status":"affected"},{"version":"6.12.2","lessThan":"6.12.114","versionType":"semver","status":"affected"},{"version":"5.4.297","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.10.231","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.15.174","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.120","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.11.11","lessThan":"6.12","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/hci_sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/55b76500546e5f2e7fdd7ae7283530b620de6e61","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/66cc55b69928b742d24b4c5b66d195ae96900e48","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b851b09b392da68bd715601f10a5adb2d8d19b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e9ece97b8e716890793de261574b8efef7d8702","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eeabdb25c3209569367e99a85ca9a503b64a646d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97976","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:25.570","lastModified":"2026-10-19T10:17:48.987","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: validate packet_len before skb_put_data\n\nbtintel_pcie_submit_rx_work() reads packet_len from rfh_hdr without\nchecking if it exceeds the RX buffer size. An oversized packet_len\ncan lead to an out-of-bounds read in skb_put_data().\n\nValidate packet_len to ensure it is non-zero and does not exceed\nBTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr), logging an error when\ninvalid.\n\nThis issue was reported by Claude Mythos. It can be simulated either by\nusing customized firmware configured to return an invalid packet_len or\nby modifying rfh_hdr->packet_len in the driver before calling\nbtintel_pcie_submit_rx_work()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/bluetooth/btintel_pcie.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e","lessThan":"ab0159b1f7214ce9bad9862751e4553e635a21b1","versionType":"git","status":"affected"},{"version":"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e","lessThan":"73a50c636425cb9f7ab647b5a97bd14dd5610076","versionType":"git","status":"affected"},{"version":"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e","lessThan":"46884c0f92708f1d218fc94d88800227a19b52f8","versionType":"git","status":"affected"},{"version":"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e","lessThan":"6436e1b5331b1aebf905c13e0880a37032719b75","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/bluetooth/btintel_pcie.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/46884c0f92708f1d218fc94d88800227a19b52f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6436e1b5331b1aebf905c13e0880a37032719b75","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/73a50c636425cb9f7ab647b5a97bd14dd5610076","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab0159b1f7214ce9bad9862751e4553e635a21b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97977","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:25.680","lastModified":"2026-10-19T10:17:49.073","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: Fix UAF of btusb_data by rx_work\n\nbtusb_close() and btusb_flush() cancel data->rx_work with the\nasynchronous cancel_delayed_work(), so if btusb_rx_work() is already\nrunning on another CPU it keeps running after the cancel returns.\n\nbtusb_disconnect() calls hci_unregister_dev(), which invokes\nbtusb_close(), and then frees the btusb_data. A still running\nbtusb_rx_work() then dereferences the freed data:\n\n\twhile ((skb = skb_dequeue(&data->acl_q)))\n\t\tdata->recv_acl(data->hdev, skb);\n\nUse cancel_delayed_work_sync() instead. In btusb_close() the cancel also\nhas to happen after btusb_stop_traffic(), otherwise an URB completion\nracing with the cancel can requeue the work right after it has been\nwaited for."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/bluetooth/btusb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"800fe5ec302e1ebbf5e3f891f886deecd49c7132","lessThan":"fc654a72a8d979db15e2773a481e931abaf5a9e8","versionType":"git","status":"affected"},{"version":"800fe5ec302e1ebbf5e3f891f886deecd49c7132","lessThan":"5242050195a711e9cd6a9935f689ab6656b94a91","versionType":"git","status":"affected"},{"version":"800fe5ec302e1ebbf5e3f891f886deecd49c7132","lessThan":"472d005622525b7be155cac99dde2252b0163bd1","versionType":"git","status":"affected"},{"version":"800fe5ec302e1ebbf5e3f891f886deecd49c7132","lessThan":"93b59937bda3fffc6386c79f5544a39bc680c8e8","versionType":"git","status":"affected"},{"version":"800fe5ec302e1ebbf5e3f891f886deecd49c7132","lessThan":"fa391adb9c755515a89993634745e9079e5ef37c","versionType":"git","status":"affected"},{"version":"800fe5ec302e1ebbf5e3f891f886deecd49c7132","lessThan":"1c12c3117639e78940959d956519c758c57d0849","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/bluetooth/btusb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.17","status":"affected"},{"version":"0","lessThan":"5.17","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1c12c3117639e78940959d956519c758c57d0849","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/472d005622525b7be155cac99dde2252b0163bd1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5242050195a711e9cd6a9935f689ab6656b94a91","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/93b59937bda3fffc6386c79f5544a39bc680c8e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fa391adb9c755515a89993634745e9079e5ef37c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc654a72a8d979db15e2773a481e931abaf5a9e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97978","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:25.790","lastModified":"2026-10-21T13:21:18.243","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\neth: ice: don't dereference pointers from TP_printk()\n\nAfter forwarding net-next during the v7.3 merge window we started\nseeing:\n\n  TRACE EVENT ERROR: Event ice_tx_dim_work has double dereference in TP_printk: REC->q_vector->tx.tx_ring->q_index\n  WARNING: kernel/trace/trace_events.c:420 at test_double_dereference.cold+0x39/0x4b\n\nthis is due to extra checks added in tracing subsystem in\ncommit b5cc230af5e5 (\"tracing: Warn when an event dereferences a pointer in TP_printk()\").\n\nPrinting happens long after the event was recorded, by which point\nthe pointers may be invalid (the ring or the dim instance).\nCopy the eight scalars into the event instead."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/intel/ice/ice_trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3089cf6d3caa1eb344aac05c875f4aeaf891552d","lessThan":"385aa7dbc6af11d90a5dd1261dbe75950eb7ca93","versionType":"git","status":"affected"},{"version":"3089cf6d3caa1eb344aac05c875f4aeaf891552d","lessThan":"ae230874e3ba27e975a9bb21a6ffd05d6a2ea318","versionType":"git","status":"affected"},{"version":"3089cf6d3caa1eb344aac05c875f4aeaf891552d","lessThan":"0b0d2f9db2406aa541a8bc3737f4f4aae1cafde9","versionType":"git","status":"affected"},{"version":"3089cf6d3caa1eb344aac05c875f4aeaf891552d","lessThan":"c42db35518bb0eae42ec955520eee0aa94a4a6fe","versionType":"git","status":"affected"},{"version":"3089cf6d3caa1eb344aac05c875f4aeaf891552d","lessThan":"b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/intel/ice/ice_trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0b0d2f9db2406aa541a8bc3737f4f4aae1cafde9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/385aa7dbc6af11d90a5dd1261dbe75950eb7ca93","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae230874e3ba27e975a9bb21a6ffd05d6a2ea318","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c42db35518bb0eae42ec955520eee0aa94a4a6fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97979","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:25.897","lastModified":"2026-10-19T10:17:49.257","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: add missing xa_destroy for sched_node_ids\n\nCommit 16dfa49406bc (\"ice: Introduce new parameters in ice_sched_node\")\nadded a sched_node_ids xarray to the port info structure, but never called\nxa_destroy on it.\n\nSince xarrays can allocate internal memory, this can result in a memory\nleak even if every element in the xarray has been removed.\n\nThe xarray is currently embedded in the port_info structure. This appears\nto have been done because its use is within functions that take the\nport_info as a primary argument.\n\nHowever, this complicates managing the lifecycle of the field. The\nport_info structure is allocated in ice_init_hw() using devm, and it is\nnot released until the devm cleanup when the driver is unloaded.\n\nThe ice_init_hw() function is called in many places, including devlink\nreload, and possibly during DDP load after updating the Tx scheduler\nlayout.\n\nAdding a call of xa_destroy to the ice_deinit_hw() causes Sashiko to raise\nmultiple concerns due to potential ordering issues and possible ways that\nport_info could be a dangling reference.\n\nTo handle this, move the sched_node_ids out of port_info and into the hw\nstructure. All users of the array already have a pointer to hw anyways, and\nthere is only one sched_node_ids per adapter. While here, remove the overly\nverbose comment explaining the nature of the sched_node_ids xarray.\n\nAdd the missing xa_destroy to the cleanup path and to ice_deinit_hw(),\nensuring that we properly release the xarray memory.\n\nThis was caught by Sashiko during development of unrelated code."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/intel/ice/ice_common.c","drivers/net/ethernet/intel/ice/ice_sched.c","drivers/net/ethernet/intel/ice/ice_type.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a388961be5ed8ee037ac68220e389bc4e9339a39","lessThan":"09a7cdf8fffb065a8aa30cfa604ff4a65cbf04c9","versionType":"git","status":"affected"},{"version":"16dfa49406bc5e1f4cbb115027cbd719d7e6c930","lessThan":"c075a91fe5762d314e6e182d37d29cf874bd314a","versionType":"git","status":"affected"},{"version":"16dfa49406bc5e1f4cbb115027cbd719d7e6c930","lessThan":"44cdd6b7e036303f7fecf841cf23c05a4a4faf2d","versionType":"git","status":"affected"},{"version":"16dfa49406bc5e1f4cbb115027cbd719d7e6c930","lessThan":"f5463bc124c0d6f922e272336584730c5c61c4f1","versionType":"git","status":"affected"},{"version":"16dfa49406bc5e1f4cbb115027cbd719d7e6c930","lessThan":"d6f38fb12069fb1edf762962b5fcf3f42d643b47","versionType":"git","status":"affected"},{"version":"16dfa49406bc5e1f4cbb115027cbd719d7e6c930","lessThan":"53432c4c3e869076350aef319534431af8ba99c1","versionType":"git","status":"affected"},{"version":"6.1.95","lessThan":"6.1.189","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/intel/ice/ice_common.c","drivers/net/ethernet/intel/ice/ice_sched.c","drivers/net/ethernet/intel/ice/ice_type.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/09a7cdf8fffb065a8aa30cfa604ff4a65cbf04c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/44cdd6b7e036303f7fecf841cf23c05a4a4faf2d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/53432c4c3e869076350aef319534431af8ba99c1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c075a91fe5762d314e6e182d37d29cf874bd314a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6f38fb12069fb1edf762962b5fcf3f42d643b47","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5463bc124c0d6f922e272336584730c5c61c4f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97980","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:26.023","lastModified":"2026-10-19T10:17:49.367","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/debug: Fix NULL pointer dereference in debug_set_level()\n\nCommit a2cec6863709 (\"s390/debug: Add s390dbf kernel parameter\")\nincorrectly removed a null-id check from debug_set_level(), introducing\na possible NULL pointer dereference for debug-API users that put\ndebug_register() results unchecked into debug_set_level().\n\nFix this by moving the check from the internal _debug_set_level()\nvariant back to the external debug_set_level() wrapper."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/s390/kernel/debug.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a2cec6863709d6673a025acc066c962b85a75842","lessThan":"716e1cd3783806929407dbd596e6b1118971eb9e","versionType":"git","status":"affected"},{"version":"a2cec6863709d6673a025acc066c962b85a75842","lessThan":"b1eb31d533cdfcae1011ed53850d52f36afe5774","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/s390/kernel/debug.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/716e1cd3783806929407dbd596e6b1118971eb9e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1eb31d533cdfcae1011ed53850d52f36afe5774","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97981","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:26.127","lastModified":"2026-10-19T10:17:49.453","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: cortina: Count dropped frames as NAPI work\n\nThe RX loop only consumes budget when it successfully delivers a frame.\nError paths keep consuming descriptors without reducing the budget, so a\nstream of bad frames can process the entire receive ring in one poll.\n\nMove the budget accounting to a common end-of-frame path. This counts\neach completed frame as NAPI work whether it was delivered or dropped,\nmatching the behavior of the vendor driver."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/cortina/gemini.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"620b7184808b25cf58268856f892b9ba83c181fd","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"9620e2ce9b5998ebbf157241f296f8ddb92285c2","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"27b5753077d1cfda5fe201d2ba602de76a9a09b1","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"e858b9b1ea3cbbc353189d07dec40dc16967e290","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"58140f1cebb776d174dc6ff41c15401654a5b1ea","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"cceb6cd7f0e5ed2944a9ca22443d7b9da82f60ab","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"5754e0c0758805096ecfeaf4c1b146ad51ed246f","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"b856c552f556bc0341c1dbe0bf88e630fd1dc4b7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/cortina/gemini.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/27b5753077d1cfda5fe201d2ba602de76a9a09b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5754e0c0758805096ecfeaf4c1b146ad51ed246f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/58140f1cebb776d174dc6ff41c15401654a5b1ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/620b7184808b25cf58268856f892b9ba83c181fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9620e2ce9b5998ebbf157241f296f8ddb92285c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b856c552f556bc0341c1dbe0bf88e630fd1dc4b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cceb6cd7f0e5ed2944a9ca22443d7b9da82f60ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e858b9b1ea3cbbc353189d07dec40dc16967e290","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97982","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:26.230","lastModified":"2026-10-19T10:17:49.560","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: cortina: Fix budget accounting\n\nThe gmac_rx() function returns the remaining NAPI budget, but its\ncaller treats the return value as the number of packets received. An\nidle poll therefore reports a full budget and remains scheduled.\n\nReturn the number of received packets instead. Preserve the existing\nfree queue refill accounting by adding that count directly; continuing\nto subtract it from the budget would invert the refill behavior."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/cortina/gemini.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"d3deb54d9507c2d7f05efd896142095eef5b7d85","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"e6e5732b90d0fc25fd3d9961ff61e660297d7608","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"aa339ac334d4e51f43af9d2901e6faf11ffd981e","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"4ca84049c6428c665ef7c903a32a99ed0f1e01e9","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"631c47e2e1154f2741c555b91df1b8cb99294c6a","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"0ef8eaef5806c84db2334111d6f299c246a592bc","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"94e06e12a376710587cfeea481b65e7c49747003","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"a0de06d0da78a3db53de65dfd7452cc6d111f703","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/cortina/gemini.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0ef8eaef5806c84db2334111d6f299c246a592bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4ca84049c6428c665ef7c903a32a99ed0f1e01e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/631c47e2e1154f2741c555b91df1b8cb99294c6a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94e06e12a376710587cfeea481b65e7c49747003","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0de06d0da78a3db53de65dfd7452cc6d111f703","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa339ac334d4e51f43af9d2901e6faf11ffd981e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3deb54d9507c2d7f05efd896142095eef5b7d85","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6e5732b90d0fc25fd3d9961ff61e660297d7608","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97983","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:26.340","lastModified":"2026-10-19T10:17:49.663","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvduse: return compat ioctl results directly\n\nThe compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but\nthen calls the native handler. Their different command sizes make native\ndispatch return -ENOIOCTLCMD.\n\nFor GET_FD, this overwrites receive_fd()'s return value after the\ndescriptor is installed, leaking one fd per call. Return handled compat\nresults directly and use native dispatch only for other commands."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/vdpa/vdpa_user/vduse_dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"455a2a1af92651764e9eb42cec0d95ac142afc28","lessThan":"135ac58097fa5fc707bf392c5cececf59e4080c0","versionType":"git","status":"affected"},{"version":"455a2a1af92651764e9eb42cec0d95ac142afc28","lessThan":"48a4ee65e677559776349128e6a81a6041986c99","versionType":"git","status":"affected"},{"version":"7dd28904c42ee3b0728c0692dd3332c2c83e8f33","versionType":"git","status":"affected"},{"version":"7.1.5","lessThan":"7.2","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/vdpa/vdpa_user/vduse_dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/135ac58097fa5fc707bf392c5cececf59e4080c0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/48a4ee65e677559776349128e6a81a6041986c99","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97984","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:26.443","lastModified":"2026-10-19T10:17:49.753","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: Fix UDP length overflow with PMTU discover and big MTU\n\nThis commit bounds cork->base.fragsize to IP6_MAX_MTU for UDP sockets to\navoid a possible overflow of UDP length that triggers a WARN in\nudp_set_len_short when setsockopt IPV6_MTU_DISCOVER is set to\nIPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE, and a large packet is sent over\na netdev with an unusually large MTU.\n\nSteps to reproduce (included in the new selftest):\n\n1. Set device MTU bigger than IP6_MAX_MTU. cork->base.fragsize will be\n   set to that MTU in ip6_setup_cork.\n2. Set IPV6_MTU_DISCOVER to IPV6_PMTUDISC_PROBE or IPV6_PMTUDISC_DO. It\n   lets maxnonfragsize be set to device MTU (cork->fragsize) in\n   __ip6_append_data, rather than to IP6_MAX_MTU.\n3. Send 65528 bytes of payload (+8 bytes of UDP header, +40 bytes of\n   IPv6 header). Device MTU allows it (it's only one byte bigger than\n   IP6_MAX_MTU, and the device MTU is bigger than that).\n4. The UDP length in the built packet is 65536, which overflows the\n   16-bit length field and triggers the WARN in udp_set_len_short.\n\nTo avoid breaking sending UDP jumbograms over raw IPv6 sockets, limit\nthe change to UDP sockets only.\n\nThe original overflow bug with IPv6 and IPV6_PMTUDISC_DO seems to\npredate git history (verified reproduction on 2.6.21), was fixed later,\nand then reappeared in commit 427faee167bc (\"net: ipv6: introduce\nip6_dst_mtu_maybe_forward\"), which is chosen as the Fixes tag here. The\noverflow with IPV6_PMTUDISC_PROBE reproduces since its introduction in\ncommit 628a5c561890 (\"[INET]: Add IP(V6)_PMTUDISC_RPOBE\")."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/ip6_output.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"427faee167bce4ccb0b22f6815a9ac509e31d4c3","lessThan":"1dd562f3019019ffdf4b396570613053facda9ee","versionType":"git","status":"affected"},{"version":"427faee167bce4ccb0b22f6815a9ac509e31d4c3","lessThan":"1d56a00ec91f2885c64ea5b8cea18cb746b91bbb","versionType":"git","status":"affected"},{"version":"427faee167bce4ccb0b22f6815a9ac509e31d4c3","lessThan":"ce66352d3eb21825410af8b91db7cc4bb8e22c98","versionType":"git","status":"affected"},{"version":"427faee167bce4ccb0b22f6815a9ac509e31d4c3","lessThan":"e01b7c176d9af2b7c22bb3fe12cf9a7904f99fdc","versionType":"git","status":"affected"},{"version":"427faee167bce4ccb0b22f6815a9ac509e31d4c3","lessThan":"0ae10b6be49b425827659b23bcce498f80eb7182","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/ip6_output.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0ae10b6be49b425827659b23bcce498f80eb7182","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1d56a00ec91f2885c64ea5b8cea18cb746b91bbb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1dd562f3019019ffdf4b396570613053facda9ee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce66352d3eb21825410af8b91db7cc4bb8e22c98","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e01b7c176d9af2b7c22bb3fe12cf9a7904f99fdc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97985","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:26.560","lastModified":"2026-10-21T13:21:18.350","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Update last skb marker in manage_oob().\n\nFahad Alharbi reported that blocking recv(MSG_PEEK) could hog CPU\ndue to OOB skb.\n\nIn the following cases, manage_oob() skips OOB skb(s) and returns\nNULL for the last recv(MSG_PEEK):\n\n  socketpair(AF_UNIX, SOCK_STREAM, 0, sk);\n\n  1) skb -> OOB skb -> NULL\n     send(sk[0], \"ab\", 2, MSG_OOB);\n     recv(sk[1], buf, 0, MSG_PEEK);\n\n  2) skb -> consumed OOB skb -> NULL\n     send(sk[0], \"ab\", 2, MSG_OOB);\n     recv(sk[1], buf, 1, MSG_OOB);\n     recv(sk[1], buf, 0, MSG_PEEK);\n\n  3) consumed OOB skb -> OOB skb -> NULL\n     send(sk[0], \"a\", 1, MSG_OOB);\n     recv(sk[1], buf, 0, MSG_OOB);\n     send(sk[0], \"b\", 1, MSG_OOB);\n     recv(sk[1], buf, 1, MSG_PEEK);\n\nThen, @copied is 0 in unix_stream_read_generic() (zero-length buffer,\nor non-OOB skb is not yet consumed), and unix_stream_data_wait() is\ncalled.\n\nHowever, it returns immediately because @last is not updated in\nunix_stream_read_generic(), and the thread busy-waits for a new skb.\n\nLet's update @last in manage_oob().\n\nFor MSG_PEEK, @last is updated with the skipped OOB, and for the\nnon-peek case, @last matches the returned value (when !copied)\nbecause OOB is unlinked.\n\nNote that manage_oob() is inlined and no stack canary is added."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/unix/af_unix.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"022d81a709cd553bbe2db8675f8e824f4aee6284","lessThan":"bd91dc313afe21e9d6b31ca6a47606a33ca5e35c","versionType":"git","status":"affected"},{"version":"22dd70eb2c3d754862964377a75abafd3167346b","lessThan":"0630bfc773d85ac44da05b2c5a037dbbd39301ab","versionType":"git","status":"affected"},{"version":"22dd70eb2c3d754862964377a75abafd3167346b","lessThan":"f1816b3d7ce80dcf086bb68ff5ae6e09520ca1fa","versionType":"git","status":"affected"},{"version":"22dd70eb2c3d754862964377a75abafd3167346b","lessThan":"fc62a26493a98a0424d9dae2eb92a1daa1321f65","versionType":"git","status":"affected"},{"version":"22dd70eb2c3d754862964377a75abafd3167346b","lessThan":"94fd4debd2e3a69cf93e766c8b328a810c228119","versionType":"git","status":"affected"},{"version":"ae3f9e1221b31b18dbd4c4b85d08574996bbd973","versionType":"git","status":"affected"},{"version":"ba0db4638525b8b054b3d546b45f7e473f477027","versionType":"git","status":"affected"},{"version":"16dc252e7007547a7b72a2c21022ef81fb45e6a3","versionType":"git","status":"affected"},{"version":"6.6.29","lessThan":"6.6.160","versionType":"semver","status":"affected"},{"version":"5.15.157","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.88","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.8.8","lessThan":"6.9","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/unix/af_unix.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0630bfc773d85ac44da05b2c5a037dbbd39301ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94fd4debd2e3a69cf93e766c8b328a810c228119","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd91dc313afe21e9d6b31ca6a47606a33ca5e35c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1816b3d7ce80dcf086bb68ff5ae6e09520ca1fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc62a26493a98a0424d9dae2eb92a1daa1321f65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97986","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:26.683","lastModified":"2026-10-19T10:17:49.960","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_input: stop callbacks before unregistering input device\n\nvirtinput_remove() unregisters the input device before resetting the\nvirtio device. virtinput_recv_events() drops vi->lock around input_event(),\nso clearing vi->ready does not stop a callback that passed the entry check.\nIt can still use vi->idev, requeue buffers and kick the queue.\n\nReset first, as virtinput_freeze() already does. With the preceding core\nchange, reset waits for callbacks before input_unregister_device() can\nfree vi->idev. Recheck vi->ready after taking the lock again: keep draining\ncompleted events so an input packet is not truncated, but stop requeueing\nbuffers and kicking the queue.\n\nWith evdev attached, input_unregister_handle() currently waits for an RCU\ngrace period, which also waits out IRQ callbacks. This masks the lifetime\nbug on PCI and MMIO, but does not protect sleepable callbacks on other\ntransports."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/virtio/virtio_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"271c865161c57cfabca45b93eaa712b19da365bc","lessThan":"3ae729b1f8ab81d1244061872db2fb0ebb110d2a","versionType":"git","status":"affected"},{"version":"271c865161c57cfabca45b93eaa712b19da365bc","lessThan":"81073bca2062c916c818f2744fbab545a5c4982b","versionType":"git","status":"affected"},{"version":"271c865161c57cfabca45b93eaa712b19da365bc","lessThan":"8226aeee9b9a94cd699fbb51cb230feff46cfaf2","versionType":"git","status":"affected"},{"version":"271c865161c57cfabca45b93eaa712b19da365bc","lessThan":"a3ba86a270dd87460759214046dc7cbd409ac711","versionType":"git","status":"affected"},{"version":"271c865161c57cfabca45b93eaa712b19da365bc","lessThan":"5378f7945856a5ed88e6f9850bc7a68f54090135","versionType":"git","status":"affected"},{"version":"271c865161c57cfabca45b93eaa712b19da365bc","lessThan":"d7808b37da0a619cf1fa541c2384e783fecc2480","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/virtio/virtio_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.1","status":"affected"},{"version":"0","lessThan":"4.1","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3ae729b1f8ab81d1244061872db2fb0ebb110d2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5378f7945856a5ed88e6f9850bc7a68f54090135","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81073bca2062c916c818f2744fbab545a5c4982b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8226aeee9b9a94cd699fbb51cb230feff46cfaf2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3ba86a270dd87460759214046dc7cbd409ac711","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7808b37da0a619cf1fa541c2384e783fecc2480","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97987","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:26.797","lastModified":"2026-10-19T10:17:50.063","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_input: reset device if input_register_device() fails\n\nProbe marks the device DRIVER_OK with virtio_device_ready() before\ncalling input_register_device(). If registration fails, the error path\ncleared vi->ready and called del_vqs() while the device was still live,\nso the device could keep DMA to queues that were already torn down.\n\nMatch remove/freeze: call virtio_reset_device() on that path before\ntearing down the virtqueues."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/virtio/virtio_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"271c865161c57cfabca45b93eaa712b19da365bc","lessThan":"087b9ee4d36968329c846e6846e4e50f66532888","versionType":"git","status":"affected"},{"version":"271c865161c57cfabca45b93eaa712b19da365bc","lessThan":"16c90260ae7ae32d7ac9128fb5da404c37154765","versionType":"git","status":"affected"},{"version":"271c865161c57cfabca45b93eaa712b19da365bc","lessThan":"9a7e107734137f098f9b81e5615aa5a02c5395c7","versionType":"git","status":"affected"},{"version":"271c865161c57cfabca45b93eaa712b19da365bc","lessThan":"8407da8974326c1ffdfe6a5a9bfc8fed3212bbdf","versionType":"git","status":"affected"},{"version":"271c865161c57cfabca45b93eaa712b19da365bc","lessThan":"668ebfea7ba623450b12fdeaa0d080464d0c0a14","versionType":"git","status":"affected"},{"version":"271c865161c57cfabca45b93eaa712b19da365bc","lessThan":"81489b32a21c9360f8750d1fb600155d27452e19","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/virtio/virtio_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.1","status":"affected"},{"version":"0","lessThan":"4.1","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/087b9ee4d36968329c846e6846e4e50f66532888","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/16c90260ae7ae32d7ac9128fb5da404c37154765","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/668ebfea7ba623450b12fdeaa0d080464d0c0a14","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81489b32a21c9360f8750d1fb600155d27452e19","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8407da8974326c1ffdfe6a5a9bfc8fed3212bbdf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a7e107734137f098f9b81e5615aa5a02c5395c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97988","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:26.903","lastModified":"2026-10-21T13:21:18.470","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: invalidate vring access on IOTLB transitions\n\nWhen VIRTIO_F_ACCESS_PLATFORM changes, cached vring pointers and IOTLB\nmetadata are interpreted in a different address space. Keeping them\nacross the transition can leave stale ring mappings in use.\n\nClearing d->iotlb before taking the VQ locks also lets a worker observe\na transient NULL d->iotlb and fall back to d->umem while translating a\ndescriptor.\n\nAdd a common vhost_clear_device_iotlb() helper for vhost-net and\nvhost-vsock. Take all VQ mutexes in index order before dropping the\ndevice-wide IOTLB, invalidate each VQ's cached ring access and metadata,\nclear pending IOTLB messages, and free the old table after the handoff.\nThis serializes the transition with workers and prevents mixed address\nspace mappings.\n\nOn the first direct-to-IOTLB transition, invalidate the cached vring\naddresses. When an existing device IOTLB is replaced, preserve the\nGIOVA ring addresses and reset only the metadata cache. After clearing\nACCESS_PLATFORM, userspace must configure the vring addresses for the\nnew address mode.\n\nvhost_vq_invalidate_access() clears desc, avail, and used together.\nTreat the VQ as invalidated only when all three are NULL, since a single\nGIOVA address may legitimately be zero."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/vhost/net.c","drivers/vhost/vhost.c","drivers/vhost/vhost.h","drivers/vhost/vsock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6b1e6cc7855b09a0a9bfa1d9f30172ba366f161c","lessThan":"021bf73731f7aa94540a549cf850db5968019960","versionType":"git","status":"affected"},{"version":"6b1e6cc7855b09a0a9bfa1d9f30172ba366f161c","lessThan":"e8fe13c14d57cc7c6bd69c72c5fabaaf0d918f98","versionType":"git","status":"affected"},{"version":"6b1e6cc7855b09a0a9bfa1d9f30172ba366f161c","lessThan":"7f8ee0b8f632441aec456a7c147fb43f5c73542d","versionType":"git","status":"affected"},{"version":"6b1e6cc7855b09a0a9bfa1d9f30172ba366f161c","lessThan":"4a454af8e56c1596ada1421ae5eba90c8896c7c7","versionType":"git","status":"affected"},{"version":"6b1e6cc7855b09a0a9bfa1d9f30172ba366f161c","lessThan":"e4f4761879a230aa59e569102a6ab9851847d833","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/vhost/net.c","drivers/vhost/vhost.c","drivers/vhost/vhost.h","drivers/vhost/vsock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.8","status":"affected"},{"version":"0","lessThan":"4.8","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/021bf73731f7aa94540a549cf850db5968019960","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a454af8e56c1596ada1421ae5eba90c8896c7c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f8ee0b8f632441aec456a7c147fb43f5c73542d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e4f4761879a230aa59e569102a6ab9851847d833","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8fe13c14d57cc7c6bd69c72c5fabaaf0d918f98","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97989","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:27.010","lastModified":"2026-10-21T13:21:18.580","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvduse: validate virtqueue alignment\n\nvduse_validate_config() only checks the upper bound of vq_align. Invalid\nvalues can therefore reach vring_create_virtqueue_map(). The split-ring\nhelpers use align - 1 as a bit mask, so the alignment must be a non-zero\npower of two. A zero value makes vring_size() drop the descriptor and\navailable-ring part and vring_init() leave the used ring pointer NULL.\n\nThe VIRTIO spec requires the used ring to start at an address\naligned to at least 4 bytes. Reject values below VRING_USED_ALIGN_SIZE as\nwell as non-power-of-two values before they reach the virtio ring helpers.\n\nOpening a virtio-net device created with vq_align=0 triggered:\n\nBUG: KASAN: null-ptr-deref in virtqueue_kick_prepare_split+0xe3/0x100\nRead of size 2 at addr 0000000000000000 by task systemd-network/1062\n\nCall Trace (relevant frames):\n dump_stack_lvl\n print_report\n kasan_report\n __asan_load2\n virtqueue_kick_prepare_split+0xe3/0x100\n virtqueue_kick_prepare+0x40/0x60\n try_fill_recv+0x857/0x1250\n virtnet_open+0x189/0x460\n __dev_open+0x225/0x390\n __dev_change_flags+0x368/0x3b0\n netif_change_flags+0x56/0xc0\n do_setlink.isra.0+0x68c/0x1e30\n\nValidate the value before it reaches the virtio ring helpers."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/vdpa/vdpa_user/vduse_dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c8a6153b6c59d95c0e091f053f6f180952ade91e","lessThan":"650bac9c73d3b4d83be683028283654c05346556","versionType":"git","status":"affected"},{"version":"c8a6153b6c59d95c0e091f053f6f180952ade91e","lessThan":"5d4bdca17d87c90b1d888f8846a781a18aa453c9","versionType":"git","status":"affected"},{"version":"c8a6153b6c59d95c0e091f053f6f180952ade91e","lessThan":"831dab9b9bcc184adf78f18b5b788316e3174aec","versionType":"git","status":"affected"},{"version":"c8a6153b6c59d95c0e091f053f6f180952ade91e","lessThan":"c3c3b0839a1197530cc18f535062fc84dbdfc885","versionType":"git","status":"affected"},{"version":"c8a6153b6c59d95c0e091f053f6f180952ade91e","lessThan":"fa2c25b4add57888acfa89e398389e267bff3dcf","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/vdpa/vdpa_user/vduse_dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5d4bdca17d87c90b1d888f8846a781a18aa453c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/650bac9c73d3b4d83be683028283654c05346556","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/831dab9b9bcc184adf78f18b5b788316e3174aec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3c3b0839a1197530cc18f535062fc84dbdfc885","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fa2c25b4add57888acfa89e398389e267bff3dcf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97990","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:27.113","lastModified":"2026-10-19T10:17:50.350","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim_net: check TX pull result before RX copy\n\nvringh_iov_pull_iotlb() returns a signed byte count.  A failed TX pull is\ncurrently added to the unsigned byte counter and then passed as a size_t\nlength to receive_filter() and vringh_iov_push_iotlb().  A negative error\ncan therefore become a large length in the RX path.\n\nHandle non-positive pull results before every length use.  Count the TX\nerror and complete the consumed TX descriptor with zero bytes.\n\nI found this bug myself, though the patch was written with AI assistance."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/vdpa/vdpa_sim/vdpa_sim_net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cfe226892913a448e83e7a19db93862baa3cb99c","lessThan":"1b803d382cde6d85755b363f22010208a04ba40a","versionType":"git","status":"affected"},{"version":"cfe226892913a448e83e7a19db93862baa3cb99c","lessThan":"c001abcde865b74231da8f1412c3217dbf66781e","versionType":"git","status":"affected"},{"version":"cfe226892913a448e83e7a19db93862baa3cb99c","lessThan":"3af20238a09ca180d66623e3bed16b64e9975f39","versionType":"git","status":"affected"},{"version":"cfe226892913a448e83e7a19db93862baa3cb99c","lessThan":"2bbf1c1f69991e28787e02b0a2f826289d5fc730","versionType":"git","status":"affected"},{"version":"cfe226892913a448e83e7a19db93862baa3cb99c","lessThan":"0d195797a80b77f2ec56718cd26d3ee65d0093e8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/vdpa/vdpa_sim/vdpa_sim_net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.1,"impactScore":5.8}]},"references":[{"url":"https://git.kernel.org/stable/c/0d195797a80b77f2ec56718cd26d3ee65d0093e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1b803d382cde6d85755b363f22010208a04ba40a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2bbf1c1f69991e28787e02b0a2f826289d5fc730","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3af20238a09ca180d66623e3bed16b64e9975f39","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c001abcde865b74231da8f1412c3217dbf66781e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97991","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:27.220","lastModified":"2026-10-19T10:17:50.470","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim_blk: reject out-of-range sector starts\n\nvdpasim_blk_check_range() logs an invalid start sector but continues\nvalidating the request.  The subsequent unsigned capacity subtraction can\nunderflow and let an out-of-range buffer offset reach the data path.\n\nThe invalid offset is used by three request paths.  VIRTIO_BLK_T_OUT\ncopies guest data to blk->buffer + offset through\nvringh_iov_pull_iotlb(), causing an out-of-bounds write in\n_copy_from_iter() or memcpy().  VIRTIO_BLK_T_IN copies from\nblk->buffer + offset to the guest through vringh_iov_push_iotlb(),\ncausing an out-of-bounds read in _copy_to_iter().\nVIRTIO_BLK_T_WRITE_ZEROES passes blk->buffer + offset to memset(),\ncausing an out-of-bounds write.\n\nReject starts at or beyond the capacity before the subtraction.  Treat the\ncapacity boundary as invalid because the IN and OUT paths round byte counts\ndown to sectors for validation but later copy the original byte counts.  A\nsub-sector request at the capacity boundary would otherwise still access\npast the end of the buffer.\n\nI found this bug myself, though the patch was written with AI assistance."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7d189f617f83f780915b737896a696ff605bd19f","lessThan":"2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018","versionType":"git","status":"affected"},{"version":"7d189f617f83f780915b737896a696ff605bd19f","lessThan":"36ef4d8527f71648f00347f6ba759f0b7e5e0977","versionType":"git","status":"affected"},{"version":"7d189f617f83f780915b737896a696ff605bd19f","lessThan":"000c6300776ceaf6b715780113f4275b1be4195b","versionType":"git","status":"affected"},{"version":"7d189f617f83f780915b737896a696ff605bd19f","lessThan":"14acb0d44b7d90a077beb7b92b444b90bafda9d9","versionType":"git","status":"affected"},{"version":"7d189f617f83f780915b737896a696ff605bd19f","lessThan":"a8a1413a2cfdbedc896249f461d6d92efbbfe21f","versionType":"git","status":"affected"},{"version":"7d189f617f83f780915b737896a696ff605bd19f","lessThan":"d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf","versionType":"git","status":"affected"},{"version":"7d189f617f83f780915b737896a696ff605bd19f","lessThan":"0a8693f00c408d85f086ad85d29e7030bf1e2055","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.1,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/000c6300776ceaf6b715780113f4275b1be4195b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0a8693f00c408d85f086ad85d29e7030bf1e2055","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/14acb0d44b7d90a077beb7b92b444b90bafda9d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/36ef4d8527f71648f00347f6ba759f0b7e5e0977","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8a1413a2cfdbedc896249f461d6d92efbbfe21f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97992","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:27.343","lastModified":"2026-10-21T13:21:18.687","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-vdpa: protect config_ctx from being freed under the config callback\n\nvhost_vdpa_config_cb() loads v->config_ctx and signals it without taking\na reference and without holding any lock:\n\n\tstruct eventfd_ctx *config_ctx = v->config_ctx;\n\n\tif (config_ctx)\n\t\teventfd_signal(config_ctx);\n\nVHOST_VDPA_SET_CONFIG_CALL replaces that field and drops what is normally\nthe last reference to the old context:\n\n\tswap(ctx, v->config_ctx);\n\n\tif (ctx)\n\t\teventfd_ctx_put(ctx);\n\neventfd_ctx_put() drops the last kref and frees the context immediately,\nwith no RCU grace period, so a callback that has already loaded the\npointer goes on to dereference freed memory.  The two sides share no\nlock: the ioctl runs under vhost_dev.mutex, while the parent invokes the\ncallback from its own interrupt or workqueue context.\n\nThis is not the reopen refcount underflow fixed by commit f6bbf0010ba0\n(\"vhost-vdpa: fix use-after-free of v->config_ctx\"), which was about\nvhost_vdpa_config_put() leaving a stale pointer behind.  Here the pointer\nis maintained correctly and it is the read side that is unprotected.\n\nWith VDUSE as the parent this is reachable from userspace with access to\n/dev/vduse (root by default).  VDUSE_DEV_INJECT_CONFIG_IRQ queues\ndev->inject, and vduse_dev_irq_inject() runs the callback under VDUSE's\nown dev->irq_lock, which vhost does not hold.  vduse_dev_reset() does\nflush_work(&dev->inject), but VHOST_VDPA_SET_CONFIG_CALL never goes\nthrough reset, so an inject already in flight is not waited for.  A\nprocess that injects config interrupts on the VDUSE fd while another\nthread swaps the call fd on the vhost-vdpa fd hits it in seconds:\n\n  BUG: KASAN: slab-use-after-free in native_queued_spin_lock_slowpath\n  Read of size 4 at addr ffff888107d21808 by task kworker/u17:1/2993\n  Workqueue: vduse-irq vduse_dev_irq_inject\n  Call Trace:\n   native_queued_spin_lock_slowpath+0x97/0x5b0\n   _raw_spin_lock_irqsave+0xd4/0xe0\n   eventfd_signal_mask+0x69/0x120\n   vhost_vdpa_config_cb+0x34/0x50\n   vduse_dev_irq_inject+0x46/0x60\n   process_one_work+0x468/0x950\n\n  Allocated by task 2992:\n   do_eventfd+0x50/0x200\n   __x64_sys_eventfd2+0x2e/0x40\n\n  Freed by task 2992:\n   eventfd_ctx_put+0xb9/0xc0\n   vhost_vdpa_unlocked_ioctl+0x116c/0x2190\n\nAdd a spinlock covering every access to config_ctx, so the callback\neither signals a context that is still alive or observes NULL, and the\nput happens only once no callback can reach the old value.\n\nClearing the parent's callback before the put would not be enough: of the\nin-tree set_config_cb() implementations only VDUSE takes a lock, the rest\nstore the pointer unlocked, so that would not order against an in-flight\ninvocation."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/vhost/vdpa.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"776f395004d829bbbf18c159ed9beb517a208c71","lessThan":"914c7cc2e3d10dddd3c5529cbe56557c9e01702a","versionType":"git","status":"affected"},{"version":"776f395004d829bbbf18c159ed9beb517a208c71","lessThan":"bf35c8948ab7a3eaf1f724fa1e870e3f73a1749b","versionType":"git","status":"affected"},{"version":"776f395004d829bbbf18c159ed9beb517a208c71","lessThan":"5a075ee2398929d5cc1393666f219c35332becb1","versionType":"git","status":"affected"},{"version":"776f395004d829bbbf18c159ed9beb517a208c71","lessThan":"f4a93f15ed1c8406ba5c8e5b28cafacb2b3bcd11","versionType":"git","status":"affected"},{"version":"776f395004d829bbbf18c159ed9beb517a208c71","lessThan":"62be4e3e5f5f947fbf765b914cebdc478f715d12","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/vhost/vdpa.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5a075ee2398929d5cc1393666f219c35332becb1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62be4e3e5f5f947fbf765b914cebdc478f715d12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/914c7cc2e3d10dddd3c5529cbe56557c9e01702a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf35c8948ab7a3eaf1f724fa1e870e3f73a1749b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f4a93f15ed1c8406ba5c8e5b28cafacb2b3bcd11","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97993","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:27.500","lastModified":"2026-10-19T10:17:50.730","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx\n\nvhost_vdpa_set_config_call() swaps the eventfd_ctx_fdget() return value\ninto v->config_ctx before checking it, so on failure the field briefly\nholds an ERR_PTR:\n\n\tctx = fd == VHOST_FILE_UNBIND ? NULL : eventfd_ctx_fdget(fd);\n\tswap(ctx, v->config_ctx);\n\n\tif (!IS_ERR_OR_NULL(ctx))\n\t\teventfd_ctx_put(ctx);\n\n\tif (IS_ERR(v->config_ctx)) {\n\t\tlong ret = PTR_ERR(v->config_ctx);\n\n\t\tv->config_ctx = NULL;\n\t\treturn ret;\n\t}\n\nCommit 0bde59c1723a (\"vhost-vdpa: set v->config_ctx to NULL if\neventfd_ctx_fdget() fails\") added that clearing, and spelled out the\ninvariant the rest of the file relies on: \"we consider 'v->config_ctx'\nvalid if it is not NULL\".  The window between the swap and the clearing\nstill breaks it.  vhost_vdpa_config_cb() only tests for NULL, so a config\ninterrupt delivered inside the window hands the ERR_PTR to\neventfd_signal().\n\nCheck the fd before installing it instead.  That closes the window and\nmatches how vhost_vring_ioctl() handles the same failure for the vq call\nfd.\n\nIt also stops a rejected fd from tearing down a config interrupt that was\nworking: until now the swap replaced the live context and put it, so\nafter an EBADF the device silently stopped delivering config interrupts\nuntil userspace installed a new fd."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/vhost/vdpa.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"776f395004d829bbbf18c159ed9beb517a208c71","lessThan":"e260dc9fbfdae0978e7a8698f977fbb463a657be","versionType":"git","status":"affected"},{"version":"776f395004d829bbbf18c159ed9beb517a208c71","lessThan":"66e73fa18910b39fea0941dea5fe091122240855","versionType":"git","status":"affected"},{"version":"776f395004d829bbbf18c159ed9beb517a208c71","lessThan":"4fde085eb839fbb39c25cbba5d2a091ded394877","versionType":"git","status":"affected"},{"version":"776f395004d829bbbf18c159ed9beb517a208c71","lessThan":"59fc7c1c6b4d325194ca45352180340092d95098","versionType":"git","status":"affected"},{"version":"776f395004d829bbbf18c159ed9beb517a208c71","lessThan":"388c678639a0cebfd936b3e56c64ac6a371efec2","versionType":"git","status":"affected"},{"version":"776f395004d829bbbf18c159ed9beb517a208c71","lessThan":"65faf9eaa00e408e1406fbcf675c8c8d0e27ff2a","versionType":"git","status":"affected"},{"version":"776f395004d829bbbf18c159ed9beb517a208c71","lessThan":"6b20b40f020bde236f6b8a08ff88d8653261ec2b","versionType":"git","status":"affected"},{"version":"776f395004d829bbbf18c159ed9beb517a208c71","lessThan":"e74a9fa50749b9940b4fb13199652325e08d3c4a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/vhost/vdpa.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/388c678639a0cebfd936b3e56c64ac6a371efec2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4fde085eb839fbb39c25cbba5d2a091ded394877","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59fc7c1c6b4d325194ca45352180340092d95098","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65faf9eaa00e408e1406fbcf675c8c8d0e27ff2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/66e73fa18910b39fea0941dea5fe091122240855","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b20b40f020bde236f6b8a08ff88d8653261ec2b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e260dc9fbfdae0978e7a8698f977fbb463a657be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e74a9fa50749b9940b4fb13199652325e08d3c4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97994","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:27.637","lastModified":"2026-10-19T10:17:50.850","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost/vdpa: reject VRING_NUM larger than device max\n\nvhost_vring_set_num() accepts any non-zero power-of-two queue size that\nfits in 16 bits. vhost-vdpa then passes that value to set_vq_num()\nwithout comparing it with get_vq_num_max().\n\nA process with access to /dev/vhost-vdpa-* can therefore configure a\nqueue larger than the device advertises. With vdpa_sim, the worker can\nwalk descriptors beyond the mapped descriptor ring. KASAN reports a\n16-byte out-of-bounds read, corresponding to one vring_desc, in the\nvringh IOTLB path:\n\n  BUG: KASAN: out-of-bounds in _copy_from_iter\n  Read of size 16\n  copy_from_iotlb\n  copydesc_iotlb\n  vringh_getdesc_iotlb\n  vdpasim_net_work\n\nCache get_vq_num_max() immediately after reset. Some backends derive\nit from writable queue-size state, so querying it after SET_NUM may\nreturn the current size instead of the device capability. Invalidate\nthe cached value before reset so a failed reset leaves SET_NUM\ndisabled.\n\nFor VHOST_SET_VRING_NUM, copy the complete vring state once and use\nthe same index and size for validation, vq->num, and set_vq_num().\nThis ensures that validation and use operate on the same copied values."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/vhost/vdpa.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4c8cf31885f69e86be0b5b9e6677a26797365e1d","lessThan":"4875c65ca53797a0a402fe2bb54d1b12f28b3cda","versionType":"git","status":"affected"},{"version":"4c8cf31885f69e86be0b5b9e6677a26797365e1d","lessThan":"1d09201d81b7d3e276860cc7b7dbf6c6cbe8e9b4","versionType":"git","status":"affected"},{"version":"4c8cf31885f69e86be0b5b9e6677a26797365e1d","lessThan":"68232102f20fc961327fb9e0f605a7eaadf030a9","versionType":"git","status":"affected"},{"version":"4c8cf31885f69e86be0b5b9e6677a26797365e1d","lessThan":"59522639a7d71cff4e20d594d0b9ea30dd0c77e0","versionType":"git","status":"affected"},{"version":"4c8cf31885f69e86be0b5b9e6677a26797365e1d","lessThan":"ccb1dc7c527f8c925925cf92afc76ae590dac311","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/vhost/vdpa.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1d09201d81b7d3e276860cc7b7dbf6c6cbe8e9b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4875c65ca53797a0a402fe2bb54d1b12f28b3cda","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59522639a7d71cff4e20d594d0b9ea30dd0c77e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68232102f20fc961327fb9e0f605a7eaadf030a9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ccb1dc7c527f8c925925cf92afc76ae590dac311","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97995","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:27.750","lastModified":"2026-10-19T10:17:50.947","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_console: do not free control-out buffers on remove\n\n__send_control_msg() publishes &portdev->cpkt as the control-out\nvirtqueue cookie. remove_vqs() walks every virtqueue and passes leftover\ncookies to free_buf(), which treats them as struct port_buffer and\nreads sgpages.\n\nIf a control message is still on c_ovq when the device is unbound,\nfree_buf() reads past the ports_device object.\n\nKASAN reported slab-out-of-bounds in free_buf():\n\n\tfree_buf\n\tremove_vqs\n\tvirtcons_remove\n\tunbind_store\n\nThe object was the ports_device allocated in virtcons_probe().\n\nDrain c_ovq without freeing. The packet lives in portdev and is released\nwith it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/char/virtio_console.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b","lessThan":"b1f39c2a676698cc64c8e105e08b25111a112ec6","versionType":"git","status":"affected"},{"version":"a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b","lessThan":"e03522a990cd2e0f1a736eaa349a9df9ab8541c3","versionType":"git","status":"affected"},{"version":"a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b","lessThan":"8f6cfc3eca79b8e108d0823756101e2f4f9d811f","versionType":"git","status":"affected"},{"version":"a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b","lessThan":"2e40c69b9c3448b9c6609cd02013da593b2e123b","versionType":"git","status":"affected"},{"version":"a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b","lessThan":"177ee901aa2bab02e7f1f8edbb814fd5e386ed62","versionType":"git","status":"affected"},{"version":"a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b","lessThan":"a80c33488e0bbe642ed803b13a4ac8078a70b507","versionType":"git","status":"affected"},{"version":"a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b","lessThan":"f620c40ea6862feed84deb105568b21ec53a7830","versionType":"git","status":"affected"},{"version":"a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b","lessThan":"894f98e73983f37354214a89a3a7fd35bf9e3072","versionType":"git","status":"affected"},{"version":"f92b16b815efe8207090a9b5a767618fd89542ca","versionType":"git","status":"affected"},{"version":"d2bbfac82b7942afc5d8e564d7087835280df495","versionType":"git","status":"affected"},{"version":"a88e13d9a092fbb772d380944b44eb549ef131fe","versionType":"git","status":"affected"},{"version":"dd807a784fd36f4136516d5858efb6473dda422c","versionType":"git","status":"affected"},{"version":"47cb14192bcbba3f15b1c3561e05e084e56fdef6","versionType":"git","status":"affected"},{"version":"6b1c41a0f7183702abb7a104c6c7e196ad69a6b3","versionType":"git","status":"affected"},{"version":"9037306163a6ba5587e4b5ca511ac7be4fb7295b","versionType":"git","status":"affected"},{"version":"3.16.60","lessThan":"3.17","versionType":"semver","status":"affected"},{"version":"3.18.108","lessThan":"3.19","versionType":"semver","status":"affected"},{"version":"4.1.52","lessThan":"4.2","versionType":"semver","status":"affected"},{"version":"4.4.131","lessThan":"4.5","versionType":"semver","status":"affected"},{"version":"4.9.98","lessThan":"4.10","versionType":"semver","status":"affected"},{"version":"4.14.39","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.16.7","lessThan":"4.17","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/char/virtio_console.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/177ee901aa2bab02e7f1f8edbb814fd5e386ed62","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2e40c69b9c3448b9c6609cd02013da593b2e123b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/894f98e73983f37354214a89a3a7fd35bf9e3072","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f6cfc3eca79b8e108d0823756101e2f4f9d811f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a80c33488e0bbe642ed803b13a4ac8078a70b507","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1f39c2a676698cc64c8e105e08b25111a112ec6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e03522a990cd2e0f1a736eaa349a9df9ab8541c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f620c40ea6862feed84deb105568b21ec53a7830","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97996","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:27.880","lastModified":"2026-10-19T10:17:51.080","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: fix use-after-free in unregister_virtio_device()\n\ndevice_unregister() is device_del() plus put_device(). When the caller\nholds no extra reference, that drops the last one and runs the release\ncallback, which for several transports frees the memory the embedded\nstruct virtio_device sits in. unregister_virtio_device() then calls\nvirtio_debug_device_exit(), which reads dev->debugfs_dir out of the freed\nobject.\n\nAffected transports are the ones whose release callback frees and whose\nremove path takes no reference: virtio_mmio, virtio_vdpa, virtio_uml,\nmlxbf-tmfifo and virtio_ccw. virtio_pci is unaffected because\nvirtio_pci_remove() brackets the call with get_device() and put_device().\n\nRemove the debugfs entries before the device can go away. They are only\naccessed through the protected debugfs interface, so\ndebugfs_remove_recursive() waits for in-progress file operations before\nreturning. Tearing them down while the device is still alive is therefore\nsafe.\n\nReproduced on User-Mode Linux with CONFIG_KASAN and CONFIG_VIRTIO_DEBUG\nby unbinding a virtio-uml device:\n\n  BUG: KASAN: slab-use-after-free in virtio_debug_device_exit+0x36/0x4d\n  Read of size 8 at addr 00000000616e0b10 by task init/1\n   __asan_report_load8_noabort\n   virtio_debug_device_exit+0x36/0x4d\n   unregister_virtio_device+0x48/0x75\n   virtio_uml_remove\n   platform_remove\n   device_release_driver_internal\n   unbind_store\n\n  Freed by task 1:\n   kfree\n   virtio_uml_release_dev\n   device_release\n   kobject_put\n   put_device\n   device_unregister\n\nWith this applied, the report is gone and unbind is clean."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/virtio/virtio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"96a8326d69fffd7e8c2eb737dc060d8009a33b39","lessThan":"951cad50cba89e736afdee4a730e0e52f9245c9b","versionType":"git","status":"affected"},{"version":"96a8326d69fffd7e8c2eb737dc060d8009a33b39","lessThan":"77dbd10a701a30fdfea5c3bb7a29163128f9a9c7","versionType":"git","status":"affected"},{"version":"96a8326d69fffd7e8c2eb737dc060d8009a33b39","lessThan":"caf042153016d651b55d0fb4a63cdf7d0d23dee2","versionType":"git","status":"affected"},{"version":"96a8326d69fffd7e8c2eb737dc060d8009a33b39","lessThan":"3f9a0fceb730f5107d52421ead5568eae25a0049","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/virtio/virtio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3f9a0fceb730f5107d52421ead5568eae25a0049","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/77dbd10a701a30fdfea5c3bb7a29163128f9a9c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/951cad50cba89e736afdee4a730e0e52f9245c9b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/caf042153016d651b55d0fb4a63cdf7d0d23dee2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97997","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:27.997","lastModified":"2026-10-21T13:21:18.817","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_ring: fix stale descriptor flags after a failed packed add\n\nIn a packed ring the AVAIL and USED bits sit in the descriptor itself,\nso writing them makes that descriptor available. Those bit combinations\nflip meaning on every round of the ring, tracked by a wrap counter, so\ninvalidating or validating a descriptor means inverting both bits.\n\nCommit 1ce9e6055fa0 (\"virtio_ring: introduce packed ring support\") has\nvirtqueue_add_packed() make every descriptor of a chain available as it\nmaps the chain, and write the head last. The device consumes the ring in\norder and stops at a head that is not available yet, so it never reaches\nthe rest.\n\nWhen vring_map_one_sg() fails partway, unmap_release unmaps the segments\nand restores avail_used_flags, but the descriptors it wrote to in the\nring stay marked with AVAIL and USED bits. The head is now the only\nentry that keeps the device from consuming these stale entries.\n\nFor example, the ring would look like this now.\n\n  Z - pre-previous command\n  A - previous command\n  B - aborted command\n  C - current command\n\n  [A1 DONE] [A2 DONE] <C1 EMPTY> [B2] [B3] [Z1 DONE]\n\nWhen the driver now attempts to issue the C command, the next add starts\nat the same head as B. If C spans less descriptors than B, there is no\nend marker because AVAIL and USED bits were still in place. And that\nmeans the device will start interpreting these stale entries (B2/B3) as\nanother command entry, which then blocks the queue.\n\nThis effect typically happens in swiotlb configurations under memory\npressure, because vring_map_one_sg() can then fail with larger I/O\nrequests which then leads to command abortions.\n\nThere are broadly 2 ways to avoid leaving those flags behind:\n\n  1) Defer those flags too until the chain is complete.\n  2) Rewrite those flags for the previous wrap counter.\n\nImplement the second option in both packed add paths. The first option\ntraverses the chain a second time on every successful add. The second\noption invalidates all added descriptors when any add fails.\n\nWith this patch applied, a packed virtqueue keeps completing requests\nafter a failed add."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/virtio/virtio_ring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1ce9e6055fa0a9043405c5604cf19169ec5379ff","lessThan":"5ad081761a1f0b0d95ab08b61a6008309fba95f9","versionType":"git","status":"affected"},{"version":"1ce9e6055fa0a9043405c5604cf19169ec5379ff","lessThan":"cfe8128ceb78374b0f9cebb608bb48e3928d784a","versionType":"git","status":"affected"},{"version":"1ce9e6055fa0a9043405c5604cf19169ec5379ff","lessThan":"3e6400e3b8b858cdf0f8d70b20d8b55d703af368","versionType":"git","status":"affected"},{"version":"1ce9e6055fa0a9043405c5604cf19169ec5379ff","lessThan":"d595358276b60e5df4d3930bc94033249b1d5adc","versionType":"git","status":"affected"},{"version":"1ce9e6055fa0a9043405c5604cf19169ec5379ff","lessThan":"75d276e5bb68778b2916f98a2bc30f142ebadc64","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/virtio/virtio_ring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3e6400e3b8b858cdf0f8d70b20d8b55d703af368","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ad081761a1f0b0d95ab08b61a6008309fba95f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/75d276e5bb68778b2916f98a2bc30f142ebadc64","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfe8128ceb78374b0f9cebb608bb48e3928d784a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d595358276b60e5df4d3930bc94033249b1d5adc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97998","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:28.107","lastModified":"2026-10-19T10:17:51.280","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_log: cope with concurrent instance destruction\n\nInstances are refcounted. However, only memory release happens on the\n1 -> 0 transition; the unlink from hashes can occur with any refcount.\n\nUncooperative userspace can force a situation where a queue is pending\nfor destruction from netlink event while a different socket with same\nportid processes an UNBIND request.\n\nWith right timing, this will unhash the instance again:\n\nOops: general protection fault, [..]\nCall Trace:\n <TASK>\n nfulnl_recv_config+0x31a/0xd50\n nfnetlink_rcv_msg+0x7c2/0xeb0"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nfnetlink_log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0597f2680d666a3bcf101ac0c771ba7e50016bbd","lessThan":"c5c89beaa628d6ac527c6eb2e01b2b52eb417f59","versionType":"git","status":"affected"},{"version":"0597f2680d666a3bcf101ac0c771ba7e50016bbd","lessThan":"042465e7d3d3127e21f04e42c1639e2518b98915","versionType":"git","status":"affected"},{"version":"0597f2680d666a3bcf101ac0c771ba7e50016bbd","lessThan":"291685fc8d2e4cf75ed3a23c810883653f407f46","versionType":"git","status":"affected"},{"version":"0597f2680d666a3bcf101ac0c771ba7e50016bbd","lessThan":"3161186a2ff81288e9a5f35daf1911153764ecae","versionType":"git","status":"affected"},{"version":"0597f2680d666a3bcf101ac0c771ba7e50016bbd","lessThan":"0234d7ca0317be0a623300e1693cd794bbfdf8af","versionType":"git","status":"affected"},{"version":"0597f2680d666a3bcf101ac0c771ba7e50016bbd","lessThan":"1a7a8ac9a9f0ad0d410c901cb6f233833518844c","versionType":"git","status":"affected"},{"version":"0597f2680d666a3bcf101ac0c771ba7e50016bbd","lessThan":"e2dd0f1f8c4e6334699ea6382e52f6da0c7e45eb","versionType":"git","status":"affected"},{"version":"0597f2680d666a3bcf101ac0c771ba7e50016bbd","lessThan":"387d744fa7e499d2c3748a4e60e02ebb24e7fb16","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/nfnetlink_log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.14","status":"affected"},{"version":"0","lessThan":"2.6.14","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0234d7ca0317be0a623300e1693cd794bbfdf8af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/042465e7d3d3127e21f04e42c1639e2518b98915","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1a7a8ac9a9f0ad0d410c901cb6f233833518844c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/291685fc8d2e4cf75ed3a23c810883653f407f46","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3161186a2ff81288e9a5f35daf1911153764ecae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/387d744fa7e499d2c3748a4e60e02ebb24e7fb16","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c5c89beaa628d6ac527c6eb2e01b2b52eb417f59","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2dd0f1f8c4e6334699ea6382e52f6da0c7e45eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98000","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:28.213","lastModified":"2026-10-19T10:17:51.393","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: Fix potential UAF in pec_store\n\nSashiko reports:\n\nIn pec_store(), a guard(mutex)(&hwdev->lock) is taken. If the chip write\noperation returns an error other than -EOPNOTSUPP, the code jumps to the\nput label, which calls put_device(hdev). If this drops the final reference,\nthe device is freed. When the function then returns, the guard cleanup\nfunction runs and attempts to unlock the freed mutex.\n\nUse scoped_guard() instead of guard() to avoid the problem."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/hwmon.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3ad2a7b9b15d5072139a20be84adb36776eb6c9b","lessThan":"8afab57bcdbc2186f325972e777880ac5a220f4f","versionType":"git","status":"affected"},{"version":"3ad2a7b9b15d5072139a20be84adb36776eb6c9b","lessThan":"01dd8b4fc2cf83c66565c0f382fb1841e9000a89","versionType":"git","status":"affected"},{"version":"3ad2a7b9b15d5072139a20be84adb36776eb6c9b","lessThan":"354ccc99b2dc8ba0cf6d4de34e520bcf6ecca5c2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/hwmon.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/01dd8b4fc2cf83c66565c0f382fb1841e9000a89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/354ccc99b2dc8ba0cf6d4de34e520bcf6ecca5c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8afab57bcdbc2186f325972e777880ac5a220f4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98001","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:28.320","lastModified":"2026-10-19T10:17:51.477","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (ltc4282) Make sure clk_init_data is fully initialized\n\nThe clk_init_data structure contains several mutually-exclusive members\nfor different methods to specify the possible parents of a clock,\nprompting drivers to initialize only the members they need.  However,\nnot initializing all members may cause subtle issues, which are only\nexposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is\nenabled.\n\nltc428_clk_provider_setup() does not fill in any parent clocks, and\nassumes that init.num_parents is NULL.  However, the latter in\nuninitialized, and thus may cause a crash.\n\nMake sure all members are fully initialized, to fix such bugs, and to\navoid future breakage when converting drivers to a different method for\nspecifying the parents."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/ltc4282.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cbc29538dbf7d7400f1ffc5dd5713e6a551463a0","lessThan":"c4a96da5a3f132d80aa971ddbeb86808539ba0e6","versionType":"git","status":"affected"},{"version":"cbc29538dbf7d7400f1ffc5dd5713e6a551463a0","lessThan":"80b46a3d066d4e2c1dd4edb90d4aa3f22ca79f39","versionType":"git","status":"affected"},{"version":"cbc29538dbf7d7400f1ffc5dd5713e6a551463a0","lessThan":"aa08ce1ffaf36c7bdd3edd0ad65f72413639bfad","versionType":"git","status":"affected"},{"version":"cbc29538dbf7d7400f1ffc5dd5713e6a551463a0","lessThan":"e317326d1755ea054b98e7a4833b929157461c35","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/ltc4282.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/80b46a3d066d4e2c1dd4edb90d4aa3f22ca79f39","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa08ce1ffaf36c7bdd3edd0ad65f72413639bfad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4a96da5a3f132d80aa971ddbeb86808539ba0e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e317326d1755ea054b98e7a4833b929157461c35","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98002","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:28.430","lastModified":"2026-10-19T10:17:51.570","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Fix ineffective error check in nested domain allocation\n\namd_iommu_pdom_id_alloc() returns an int: a domain ID on success, or the\nnegative errno from ida_alloc_range() when the ID space is exhausted or\nmemory is short.  amd_iommu_alloc_domain_nested() stores that return value\nin gdom_info->hdom_id, which is a u32, and only then tests it:\n\n\tgdom_info->hdom_id = amd_iommu_pdom_id_alloc();\n\tif (gdom_info->hdom_id <= 0) {\n\nThe assignment discards the sign, so -ENOSPC becomes 0xffffffe4 and the\ntest never fires.  The nested domain is then set up with a host domain ID\nthat was never allocated, instead of the allocation failing with -ENOSPC.\n\nKeep the value in an int, test it there, and store it only once it is\nknown to be valid, which is what the other amd_iommu_pdom_id_alloc()\ncallers already do."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/iommu/amd/nested.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"757d2b1fdf5b7d6eead5963a49b5780617987ab8","lessThan":"80c231f5577229d1e90a1e312b3095f9502f8625","versionType":"git","status":"affected"},{"version":"757d2b1fdf5b7d6eead5963a49b5780617987ab8","lessThan":"fa5c0827f0b7bac6d0a188f10118151769ae68fd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/iommu/amd/nested.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.1,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/80c231f5577229d1e90a1e312b3095f9502f8625","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fa5c0827f0b7bac6d0a188f10118151769ae68fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98003","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:28.533","lastModified":"2026-10-21T13:21:19.073","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Do not reallocate GA log buffers on resume\n\nCommit c5e1a1eb9279 (\"iommu/amd: Simplify and Consolidate Virtual APIC\n(AVIC) Enablement\") moved the GA log allocation from iommu_init_pci()\nto enable_iommus_vapic(), which is called on every resume.\n\niommu_init_ga_log() assigns iommu->ga_log and iommu->ga_log_tail\nunconditionally. Each resume therefore replaces the boot-time pointers\nand leaks both old allocations. The function also uses GFP_KERNEL from a\nsyscore resume callback, where interrupts are disabled and the non-boot\nCPUs are offline.\n\nReturn early if both buffers are already allocated. Clear the pointers\nin free_ga_log() so a partial allocation failure cannot leave ga_log\ndangling."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/iommu/amd/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b","lessThan":"8b95269d7a43b737c2c0e2fa77bf00cc8a3a4434","versionType":"git","status":"affected"},{"version":"c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b","lessThan":"ff85cdc2889e1c885eed218ee5bc0b59e0235b3f","versionType":"git","status":"affected"},{"version":"c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b","lessThan":"94458b80d3b203c1c9e2c98aa7319b7713e006c0","versionType":"git","status":"affected"},{"version":"c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b","lessThan":"b6be275d19cee01f8f1f08a2ff18337103d05d40","versionType":"git","status":"affected"},{"version":"c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b","lessThan":"00a7dd64888d6dd72110b40e2824a088cf7b7386","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/iommu/amd/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/00a7dd64888d6dd72110b40e2824a088cf7b7386","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b95269d7a43b737c2c0e2fa77bf00cc8a3a4434","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94458b80d3b203c1c9e2c98aa7319b7713e006c0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6be275d19cee01f8f1f08a2ff18337103d05d40","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff85cdc2889e1c885eed218ee5bc0b59e0235b3f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98004","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:28.637","lastModified":"2026-10-19T10:17:51.767","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/riscv: Serialize command queue publishing\n\nSerialize command queue publishing so software producer state advances only\nafter a command is written and the hardware tail is updated. Wait for\nhardware consumption outside the queue lock when the command queue is full\nso other CPUs are not blocked behind a long poll."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/iommu/riscv/iommu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"856c0cfe5c5f6a2cc8d995872eb67bff9c68c57c","lessThan":"787405e9e7bdc53ea7e063fe7b855171b4bd0e91","versionType":"git","status":"affected"},{"version":"856c0cfe5c5f6a2cc8d995872eb67bff9c68c57c","lessThan":"6d4c12ab9ab8db87411c863a54e0e97f9197afde","versionType":"git","status":"affected"},{"version":"856c0cfe5c5f6a2cc8d995872eb67bff9c68c57c","lessThan":"ca58afa40946acd252a50fa4d4a86f15847a3d7d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/iommu/riscv/iommu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6d4c12ab9ab8db87411c863a54e0e97f9197afde","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/787405e9e7bdc53ea7e063fe7b855171b4bd0e91","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ca58afa40946acd252a50fa4d4a86f15847a3d7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98005","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:28.740","lastModified":"2026-10-19T10:17:51.850","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: delimit inode_share cache key components\n\nPreviously, inode_share keys were encoded as follows:\n\n  fingerprint || domain_id\n\nIt would be better to have a separator between the fingerprint and domain\nID so that the fingerprint won't be parsed as part of a domain ID.\n\nChange the key encoding as follows:\n\n  domain_id || '\\0' || fingerprint\n\nSince domain_id is a NUL-terminated string, this makes the in-memory key\nindices unambiguous."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/erofs/xattr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e0bf7d1c074dc4252223ae897560345ccc24100d","lessThan":"16322a67336cfeea0af4b05206ef8d0e0eda55bb","versionType":"git","status":"affected"},{"version":"e0bf7d1c074dc4252223ae897560345ccc24100d","lessThan":"96bf9831fbf423b8104f7948cd8fe7007ecfb46c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/erofs/xattr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/16322a67336cfeea0af4b05206ef8d0e0eda55bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96bf9831fbf423b8104f7948cd8fe7007ecfb46c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98006","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:28.847","lastModified":"2026-10-19T10:17:51.943","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: Decoupling ep1_in_urb in caiaq dev\n\nThe epq_in_urb object belonging to the caiaq device is coupled within\nthe struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)\nexecutes successfully, epq_in_urb is successfully added to the urbp_list\nqueue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD\nlayer driver for the caiaq USB device).\n\nWhen init_card() calls snd_usb_caiaq_send_command() which subsequently\nfails due to a timeout, and proceeds to call snd_card_free() to release\nthe card, the embedded ep1_in_urb object is also freed. When the dummy\nHCD driver detects that the URB has been unlinked, it returns the URB\n(by usb_hcd_giveback_urb()), which triggers [1].\n\nDecouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch\nto using a pointer instead. Separately allocate and manage the memory for\nep1_in_urb to prevent the release of the snd_card memory object from\ninterfering with it.\n\nmidi_out_urb has the same issue as ep1_in_urb and is handled in the same\nway.\n\n[1]\nBUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96\nWrite of size 4 at addr ffff88803cee1050 by task ktimers/1/29\nCall Trace:\n usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96\n dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019\n __run_hrtimer kernel/time/hrtimer.c:2067 [inline]\n __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124\n hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141\n\nAllocated by task 36:\n snd_card_new+0x7b/0x110 sound/core/init.c:184\n create_card sound/usb/caiaq/device.c:429 [inline]\n snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544\n\nFreed by task 36:\n snd_card_free_when_closed sound/core/init.c:630 [inline]\n snd_card_free+0x138/0x1d0 sound/core/init.c:662\n snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/caiaq/device.c","sound/usb/caiaq/device.h","sound/usb/caiaq/midi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"a3bbd2845bc7188ae18548a591da1067af997e80","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"fbfbad728da2e95d6560e43266895de5c8e844b3","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"dbd3effcbdb85394d3c4bd5ee9df785a44303333","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"671037b282eb7fe477136bd0130ffd9029eb8668","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"d6dd3c915b0d02457711d8fbaa60efc52144557f","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"0c1b907d5db2f3508375776e5b78d69591aa5626","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"d41e6c1533f09b27fc562260d41417490d2b6084","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"402a9d6aab7ac787ab075adeb562c3db8b8f564b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/usb/caiaq/device.c","sound/usb/caiaq/device.h","sound/usb/caiaq/midi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.22","status":"affected"},{"version":"0","lessThan":"2.6.22","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0c1b907d5db2f3508375776e5b78d69591aa5626","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/402a9d6aab7ac787ab075adeb562c3db8b8f564b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/671037b282eb7fe477136bd0130ffd9029eb8668","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3bbd2845bc7188ae18548a591da1067af997e80","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d41e6c1533f09b27fc562260d41417490d2b6084","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6dd3c915b0d02457711d8fbaa60efc52144557f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dbd3effcbdb85394d3c4bd5ee9df785a44303333","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fbfbad728da2e95d6560e43266895de5c8e844b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98007","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:28.967","lastModified":"2026-10-19T10:17:52.070","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject non-scalar bpf_loop iteration counts\n\nbpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged\nprograms may pass pointer values to such arguments, so check_func_arg()\nlets a pointer-valued R1 reach the helper-specific checks.\n\nSince commit bb124da69c47 (\"bpf: keep track of max number of bpf_loop\ncallback iterations\"), the verifier marks R1 precise and reads its upper\nbound to limit callback simulation. Precision backtracking only accepts\nscalar registers, so passing a pointer instead triggers the \"backtracking\nmisuse\" verifier warning. Kernels with panic_on_warn enabled subsequently\npanic.\n\nIntroduce ARG_SCALAR for helper arguments that only accept scalar values\nand use it for bpf_loop() nr_loops. Generic helper argument validation then\nrejects pointers before loop inlining and precision processing."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/bpf.h","kernel/bpf/bpf_iter.c","kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bfc5c19b4b48840627af0d0f1c8f4461b276e508","lessThan":"2ff38b3552af53238aee6c877ae64cc798d46fce","versionType":"git","status":"affected"},{"version":"bb124da69c47dd98d69361ec13244ece50bec63e","lessThan":"656d40d1ca228ee21a9b3280432479fc9eae75ab","versionType":"git","status":"affected"},{"version":"bb124da69c47dd98d69361ec13244ece50bec63e","lessThan":"e2e1161e03fecff6d2229a81b024337144bfcd97","versionType":"git","status":"affected"},{"version":"bb124da69c47dd98d69361ec13244ece50bec63e","lessThan":"f8ae8275c721334ee50fafdd986fb83294eb941a","versionType":"git","status":"affected"},{"version":"bb124da69c47dd98d69361ec13244ece50bec63e","lessThan":"c3fd8e5fd100f122bad503bdc0e9277219533253","versionType":"git","status":"affected"},{"version":"6.6.15","lessThan":"6.6.158","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/bpf.h","kernel/bpf/bpf_iter.c","kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2ff38b3552af53238aee6c877ae64cc798d46fce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/656d40d1ca228ee21a9b3280432479fc9eae75ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3fd8e5fd100f122bad503bdc0e9277219533253","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2e1161e03fecff6d2229a81b024337144bfcd97","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8ae8275c721334ee50fafdd986fb83294eb941a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98008","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:29.080","lastModified":"2026-10-19T10:17:52.177","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: fix NULL pointer dereference on unbind with fixed-link\n\nWhen the device tree describes a fixed-link and has no \"mdio\" child\nnode, macb_mii_init() returns early without allocating the MDIO bus,\nleaving bp->mii_bus as NULL.\n\nTwo cleanup paths then dereference this NULL bus:\n\n1. On driver unbind, macb_remove() unconditionally calls\n   mdiobus_unregister(bp->mii_bus), which oopses:\n\n  Unable to handle kernel NULL pointer dereference at virtual address 00000000000004a8\n  pc : mdiobus_unregister+0x14/0xa4\n  lr : macb_remove+0x38/0xa4\n  Call trace:\n   mdiobus_unregister+0x14/0xa4 (P)\n   macb_remove+0x38/0xa4\n   platform_remove+0x20/0x30\n   device_release_driver_internal+0x1c8/0x224\n   unbind_store+0xb4/0xbc\n\n2. On the probe error path in macb_probe(), reached when\n   macb_mii_init() has succeeded but a subsequent step fails, the\n   err_out_unregister_mdio label runs the same unconditional cleanup.\n\nmdiobus_unregister() and mdiobus_free() do not guard against a NULL\nbus, so guard the calls in both macb_remove() and the probe error\npath."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/cadence/macb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"831e19e565b5210930fa183730071f8290c61263","lessThan":"afa224cabc0132ca414b9141b1a919ca2d318cd0","versionType":"git","status":"affected"},{"version":"81db1e52848694761a1aa162ce76198af9964ed8","lessThan":"054ad8e66025eb4778d840bef80c270646cebcd2","versionType":"git","status":"affected"},{"version":"d0c3601f2c4e12e7689b0f46ebc17525250ea8c3","lessThan":"f737d999fcb8f276d77b01ea4c2016ee01dad19b","versionType":"git","status":"affected"},{"version":"d0c3601f2c4e12e7689b0f46ebc17525250ea8c3","lessThan":"5710f6a74f63cbba0e15cd75917234916181c9d4","versionType":"git","status":"affected"},{"version":"d0c3601f2c4e12e7689b0f46ebc17525250ea8c3","lessThan":"edb39c7666bb3924da761dfb417db85c1e5d8ad3","versionType":"git","status":"affected"},{"version":"d0c3601f2c4e12e7689b0f46ebc17525250ea8c3","lessThan":"38b6be101006d3e7af972999f45d4f1e8250587a","versionType":"git","status":"affected"},{"version":"cafa5942bd2df3d80e3eeb2deb4bc050f7761f3d","versionType":"git","status":"affected"},{"version":"c81dcaa9cd0b66816c2ecb6c5df0b6afde9c7da5","versionType":"git","status":"affected"},{"version":"19088c5378c9fea54e552d8bc7418a3aa1e06990","versionType":"git","status":"affected"},{"version":"6.1.114","lessThan":"6.1.189","versionType":"semver","status":"affected"},{"version":"6.6.58","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"5.10.228","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.15.169","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.11.5","lessThan":"6.12","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/cadence/macb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/054ad8e66025eb4778d840bef80c270646cebcd2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38b6be101006d3e7af972999f45d4f1e8250587a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5710f6a74f63cbba0e15cd75917234916181c9d4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/afa224cabc0132ca414b9141b1a919ca2d318cd0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/edb39c7666bb3924da761dfb417db85c1e5d8ad3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f737d999fcb8f276d77b01ea4c2016ee01dad19b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98009","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:29.210","lastModified":"2026-10-19T10:17:52.293","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: ets: clamp quantum in parse and fallback paths\n\nets_qdisc_change() falls back to psched_mtu() with no floor for bands\nwithout an explicit quantum. With a crafted size table qdisc_pkt_len\nreaches ~2 GiB, so a zero psched_mtu on a headerless device makes the\ndeficit-refill loop spin under the qdisc lock.\n\nMove the floor into ets_quantum_parse() so explicitly configured quanta\nare also clamped to [256, 1<<20], not just the fallback path.\n\nConditions to recreate the bug:\n  CONFIG_NET_SCH_ETS=y. Requires CAP_NET_ADMIN (namespace-local via\n  unshare -Urn suffices).\n\n  tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sched/sch_ets.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33","lessThan":"440b66cc7b56ea38e9b878ae88da91992efaa4c4","versionType":"git","status":"affected"},{"version":"dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33","lessThan":"4ef8664eafafc8db68a1d52601f17dc008a223b7","versionType":"git","status":"affected"},{"version":"dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33","lessThan":"8b8d782c3b96376217087767dcf662cd3d25f226","versionType":"git","status":"affected"},{"version":"dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33","lessThan":"226d2702e74a570f5bfae6115b4706da4b94e5cf","versionType":"git","status":"affected"},{"version":"dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33","lessThan":"99ae477b892e203a37985ebc56f0063e072f7f4b","versionType":"git","status":"affected"},{"version":"dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33","lessThan":"8f80b113dea0bed3c1a31a4224b72775cd9ec52d","versionType":"git","status":"affected"},{"version":"dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33","lessThan":"de22c30ec5598aca8797f02082d2ee1358dfa3ff","versionType":"git","status":"affected"},{"version":"dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33","lessThan":"1c38487f46b243bfeefec0c0c86023a3904f2214","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sched/sch_ets.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1c38487f46b243bfeefec0c0c86023a3904f2214","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/226d2702e74a570f5bfae6115b4706da4b94e5cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/440b66cc7b56ea38e9b878ae88da91992efaa4c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4ef8664eafafc8db68a1d52601f17dc008a223b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b8d782c3b96376217087767dcf662cd3d25f226","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f80b113dea0bed3c1a31a4224b72775cd9ec52d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/99ae477b892e203a37985ebc56f0063e072f7f4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de22c30ec5598aca8797f02082d2ee1358dfa3ff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98010","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:29.320","lastModified":"2026-10-19T10:17:52.400","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: drr: clamp quantum in change class\n\ndrr_change_class() rejects explicit quantum==0 but falls back to\npsched_mtu() with no floor. With a crafted size table qdisc_pkt_len\nreaches ~2 GiB, so quantum=1 (or a zero psched_mtu on a headerless\ndevice) makes the deficit-refill loop spin under the qdisc lock.\n\nAdd clamp_t(u32, quantum, 256, 1<<20) after the zero reject and on the\nfallback path. The explicit-zero reject is preserved.\n\nConditions to recreate the bug:\n  CONFIG_NET_SCH_DRR=y. Requires CAP_NET_ADMIN (namespace-local via\n  unshare -Urn suffices).\n\n  tc qdisc add dev dummy0 root drr\n  tc class add dev dummy0 parent 1: classid 1:1 drr quantum 1"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sched/sch_drr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"13d2a1d2b032de08d7dcab6a1edcd47802681f96","lessThan":"e2297bbf9cf6ece86f1d1f8c683517a994990f9e","versionType":"git","status":"affected"},{"version":"13d2a1d2b032de08d7dcab6a1edcd47802681f96","lessThan":"560794ee6e040b6e1c4ac2b3c8909f341a4596ee","versionType":"git","status":"affected"},{"version":"13d2a1d2b032de08d7dcab6a1edcd47802681f96","lessThan":"23fea7e6736b2e1c6f6f2f05cccf33d36834da73","versionType":"git","status":"affected"},{"version":"13d2a1d2b032de08d7dcab6a1edcd47802681f96","lessThan":"b464affe9f9dfe41ac48930c376e3fb8596651b0","versionType":"git","status":"affected"},{"version":"13d2a1d2b032de08d7dcab6a1edcd47802681f96","lessThan":"dc8b374214ef5bba4882bbd95b361e42555cfc0d","versionType":"git","status":"affected"},{"version":"13d2a1d2b032de08d7dcab6a1edcd47802681f96","lessThan":"d43cded350fe1218493ad3d37a276aff14108ae6","versionType":"git","status":"affected"},{"version":"13d2a1d2b032de08d7dcab6a1edcd47802681f96","lessThan":"8f756ae1c87414ce9cc21b30e6e4c036d6e9e80b","versionType":"git","status":"affected"},{"version":"13d2a1d2b032de08d7dcab6a1edcd47802681f96","lessThan":"8382abec0f1568d0a5590d75a3df92f23fcf5196","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sched/sch_drr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.29","status":"affected"},{"version":"0","lessThan":"2.6.29","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/23fea7e6736b2e1c6f6f2f05cccf33d36834da73","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/560794ee6e040b6e1c4ac2b3c8909f341a4596ee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8382abec0f1568d0a5590d75a3df92f23fcf5196","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f756ae1c87414ce9cc21b30e6e4c036d6e9e80b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b464affe9f9dfe41ac48930c376e3fb8596651b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d43cded350fe1218493ad3d37a276aff14108ae6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc8b374214ef5bba4882bbd95b361e42555cfc0d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2297bbf9cf6ece86f1d1f8c683517a994990f9e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98011","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:29.427","lastModified":"2026-10-19T10:17:52.520","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: hhf: clamp quantum in change and init paths\n\nhhf_change() accepts any quantum from userspace, including 1. With a\ncrafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes\nthe deficit-refill loop spin ~2^31 times under the qdisc lock\n(a soft lockup / denial of service).\n\nAdd max(256U, ...) in hhf_change() matching fq_codel_change(). Clamp\nhhf_init() to [256, 1<<20] matching the siblings, and remove the old\nfallback that only set quantum=256 on overflow.\n\nConditions to recreate the bug:\n  CONFIG_NET_SCH_HHF=y. Requires CAP_NET_ADMIN (namespace-local via\n  unshare -Urn suffices).\n\n  tc qdisc add dev dummy0 root hhf\n  tc qdisc change dev dummy0 root hhf quantum 1 stab data 32768 size_log 15 cell_log 0"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sched/sch_hhf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"a328698d046098e6f55b3b1460cac6bab577be58","versionType":"git","status":"affected"},{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"c364ad3ab3c8a6bce469a5cbf02881ab1324c5da","versionType":"git","status":"affected"},{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"2c6dd9fc86d446a03728c43f3b96d9ae29aa058f","versionType":"git","status":"affected"},{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"6570f326a6a96bedf3d1d1dab6acc9f8c29104ec","versionType":"git","status":"affected"},{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"1113b674307ffddd402524bd1fd9d7d5629b705b","versionType":"git","status":"affected"},{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"2e77947bbf6c166e76c038663832d0914418f761","versionType":"git","status":"affected"},{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"0898c6f9fa9ce2632ae88bd0f34a878ccc6335af","versionType":"git","status":"affected"},{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"eb56a495f59baf6cad5ed80e3ffb9078098b1346","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sched/sch_hhf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.14","status":"affected"},{"version":"0","lessThan":"3.14","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0898c6f9fa9ce2632ae88bd0f34a878ccc6335af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1113b674307ffddd402524bd1fd9d7d5629b705b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c6dd9fc86d446a03728c43f3b96d9ae29aa058f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2e77947bbf6c166e76c038663832d0914418f761","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6570f326a6a96bedf3d1d1dab6acc9f8c29104ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a328698d046098e6f55b3b1460cac6bab577be58","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c364ad3ab3c8a6bce469a5cbf02881ab1324c5da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb56a495f59baf6cad5ed80e3ffb9078098b1346","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98012","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:29.537","lastModified":"2026-10-19T10:17:54.200","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sfq: clamp quantum in change path\n\nsfq_change() accepts any non-negative quantum (only rejects\n(int)ctl->quantum < 0). With a crafted size table qdisc_pkt_len reaches\n~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times\nunder the qdisc lock (a soft lockup / denial of service).\n\nAdd max(256U, ...) matching fq_codel_change(). Reject quantum > 1<<20\nwith -EINVAL, matching fq_codel_change() and the init clamp.\n\nConditions to recreate the bug:\n  CONFIG_NET_SCH_SFQ=y. Requires CAP_NET_ADMIN (namespace-local via\n  unshare -Urn suffices).\n\n  tc qdisc add dev dummy0 root sfq\n  tc qdisc change dev dummy0 root sfq quantum 1 stab data 32768 size_log 15 cell_log 0"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sched/sch_sfq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4919649699c5f4dbae08b8e2ed536fc9d6c3c2aa","lessThan":"4117c528b2de5fdc3e4a7e3626815b616a635cdc","versionType":"git","status":"affected"},{"version":"548cf048b426729a7a1fa6acd1271c010c9a7380","lessThan":"f82fa6f10d4a69322cad0f7a4aa523ce6292a5a0","versionType":"git","status":"affected"},{"version":"c49ac48fac51a6a54efd5963954d02bacf075085","lessThan":"0692ce5a528df450d64e9f819054177e9d91076f","versionType":"git","status":"affected"},{"version":"58ae7465f0e7113d45aa88a66bf2d203c71c195e","lessThan":"e4192bcf83aaab02129644ddf4656fd86e93751f","versionType":"git","status":"affected"},{"version":"82bd38bd5467ece1ee274b493f51326cf5220a5a","lessThan":"f3820dce042a673fcb28cc31c87ee14257e21a17","versionType":"git","status":"affected"},{"version":"e4650d7ae4252f67e997a632adfae0dd74d3a99a","lessThan":"534cd7ecbbc6e8a974f4003a5c1557439c6e0a72","versionType":"git","status":"affected"},{"version":"e4650d7ae4252f67e997a632adfae0dd74d3a99a","lessThan":"e6c1cb728e389354203a72bc77464c222a247aeb","versionType":"git","status":"affected"},{"version":"e4650d7ae4252f67e997a632adfae0dd74d3a99a","lessThan":"fb9f88a33c516ea5c0bcd9a22ca288b246b34567","versionType":"git","status":"affected"},{"version":"843cacb88f42f426973f1ed11c6fb562558efb27","versionType":"git","status":"affected"},{"version":"5.10.239","lessThan":"5.10.271","versionType":"semver","status":"affected"},{"version":"5.15.186","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"6.1.129","lessThan":"6.1.189","versionType":"semver","status":"affected"},{"version":"6.6.76","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.12.13","lessThan":"6.12.111","versionType":"semver","status":"affected"},{"version":"5.4.297","lessThan":"5.5","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sched/sch_sfq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0692ce5a528df450d64e9f819054177e9d91076f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4117c528b2de5fdc3e4a7e3626815b616a635cdc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/534cd7ecbbc6e8a974f4003a5c1557439c6e0a72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e4192bcf83aaab02129644ddf4656fd86e93751f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6c1cb728e389354203a72bc77464c222a247aeb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f3820dce042a673fcb28cc31c87ee14257e21a17","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f82fa6f10d4a69322cad0f7a4aa523ce6292a5a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fb9f88a33c516ea5c0bcd9a22ca288b246b34567","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98013","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:29.660","lastModified":"2026-10-19T10:17:54.357","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fq_pie: clamp quantum in change path\n\nfq_pie_change() accepts any quantum value from userspace, including 1.\nWith a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1\nmakes the deficit-refill loop spin ~2^31 times under the qdisc lock\n(a soft lockup / denial of service).\n\nAdd max(256U, ...) matching fq_codel_change().\n\nConditions to recreate the bug:\n  CONFIG_NET_SCH_FQ_PIE=y. Requires CAP_NET_ADMIN (namespace-local via\n  unshare -Urn suffices).\n\n  tc qdisc add dev dummy0 root fq_pie\n  tc qdisc change dev dummy0 root fq_pie quantum 1 stab data 32768 size_log 15 cell_log 0"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sched/sch_fq_pie.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ec97ecf1ebe485a17cd8395a5f35e6b80b57665a","lessThan":"ff4f3a0f3abd2ded467931d7da7984a68a768e0b","versionType":"git","status":"affected"},{"version":"ec97ecf1ebe485a17cd8395a5f35e6b80b57665a","lessThan":"749aaebc1eb92ce2f38fd3caf68a2f99686d84ef","versionType":"git","status":"affected"},{"version":"ec97ecf1ebe485a17cd8395a5f35e6b80b57665a","lessThan":"8fd98e56c41f79278eeb67512c28d7abc175bcf4","versionType":"git","status":"affected"},{"version":"ec97ecf1ebe485a17cd8395a5f35e6b80b57665a","lessThan":"215df1e953ae72a09d425ec188e054058ae23dc9","versionType":"git","status":"affected"},{"version":"ec97ecf1ebe485a17cd8395a5f35e6b80b57665a","lessThan":"f90fe65b977e7aa9eb302230a09eb18f8c32ceaa","versionType":"git","status":"affected"},{"version":"ec97ecf1ebe485a17cd8395a5f35e6b80b57665a","lessThan":"c11e3a39807eb5a200445ae9082843ab86800415","versionType":"git","status":"affected"},{"version":"ec97ecf1ebe485a17cd8395a5f35e6b80b57665a","lessThan":"6655b56e2801008566c594ef231f6c7b3f716c61","versionType":"git","status":"affected"},{"version":"ec97ecf1ebe485a17cd8395a5f35e6b80b57665a","lessThan":"4864f58c53eb47257d55e01f47d4a9f355f7f970","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sched/sch_fq_pie.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/215df1e953ae72a09d425ec188e054058ae23dc9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4864f58c53eb47257d55e01f47d4a9f355f7f970","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6655b56e2801008566c594ef231f6c7b3f716c61","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/749aaebc1eb92ce2f38fd3caf68a2f99686d84ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8fd98e56c41f79278eeb67512c28d7abc175bcf4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c11e3a39807eb5a200445ae9082843ab86800415","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f90fe65b977e7aa9eb302230a09eb18f8c32ceaa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff4f3a0f3abd2ded467931d7da7984a68a768e0b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98014","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:29.767","lastModified":"2026-10-19T10:17:54.773","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: E-Switch, prevent mc_list repopulation during vport disable\n\nIn mlx5_esw_vport_disable(), move esw_apply_vport_rx_mode() ahead\nof esw_vport_change_handle_locked() so vport->allmulti_rule is\nNULL before the change handler observes it.\n\nDuring FW-fatal recovery the disable runs while dev->state ==\nINTERNAL_ERROR. The promisc query inside esw_update_vport_rx_mode()\nfails and returns early, leaving vport->allmulti_rule intact, so\nesw_update_vport_mc_promisc() runs and adds MLX5_ACTION_ADD entries\nto vport->mc_list whose flow rules are then installed in the FDB\nby esw_add_mc_addr(). esw_destroy_legacy_table() tears down the\nFDB with those refs still held, corrupting the sub-tree and\nleaving dangling flow_rule pointers in vport->mc_list.\n\nTwo-stage failure on `echo 1 > /sys/bus/pci/devices/<bdf>/reset`:\n\n  refcount_t: underflow; use-after-free.\n   tree_put_node+0xef/0x110 [mlx5_core]\n   clean_tree+0x44/0xd0 [mlx5_core] (x5)\n   mlx5_fs_core_cleanup+0x57/0x1c0 [mlx5_core]\n   mlx5_unload+0x65/0xd0 [mlx5_core]\n   ... mlx5_health_try_recover\n\n  BUG: unable to handle page fault for address: 0000000003000055\n   down_write+0x1c/0x60\n   mlx5_del_flow_rules+0x33/0x1f0 [mlx5_core]\n   esw_del_mc_addr+0x7b/0x170 [mlx5_core]\n   esw_apply_vport_addr_list+0x56/0xf0 [mlx5_core]\n   esw_vport_change_handle_locked+0x28b/0x310 [mlx5_core]\n   mlx5_esw_vport_enable+0x270/0x4a0 [mlx5_core]\n   ... mlx5_load ... mlx5_health_try_recover\n\nesw_apply_vport_rx_mode(false, false) clears vport->allmulti_rule\nvia its local state machine even when the FW del fails. With the\nrule NULL the !IS_ERR_OR_NULL(allmulti_rule) gate in the change\nhandler closes, no rules are installed during disable, and the\nreload starts with a clean mc_list."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/eswitch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4df1f2d36bdc9a368650bf14b9097c555e95f71d","lessThan":"413e04adcc1fd263cf02b1b83b4a0dbdc66bcee9","versionType":"git","status":"affected"},{"version":"63546395a0e6ac264f78f65218086ce6014b4494","lessThan":"2196f9d3358b00fcb28835a5fde14071f51ecb96","versionType":"git","status":"affected"},{"version":"922f56e9a795d6f3dd72d3428ebdd7ee040fa855","lessThan":"5a2b87dfceccf9065157a14a599d395c2b6281b8","versionType":"git","status":"affected"},{"version":"922f56e9a795d6f3dd72d3428ebdd7ee040fa855","lessThan":"69904608e25e8ba58111aadd9210892cf3876201","versionType":"git","status":"affected"},{"version":"922f56e9a795d6f3dd72d3428ebdd7ee040fa855","lessThan":"72cfcb79026cffb6490f5044153a841d360b0cfc","versionType":"git","status":"affected"},{"version":"922f56e9a795d6f3dd72d3428ebdd7ee040fa855","lessThan":"668e050429c7ca688cf4e7112f97f0cd269d446b","versionType":"git","status":"affected"},{"version":"922f56e9a795d6f3dd72d3428ebdd7ee040fa855","lessThan":"c0c6f4ba8a37688f7b4d4044898d88f0450d44c2","versionType":"git","status":"affected"},{"version":"18cead61e437f4c7898acca0a5f3df12f801d97f","versionType":"git","status":"affected"},{"version":"6f5780536181d1d0d09a11a1bc92f22e143447e2","versionType":"git","status":"affected"},{"version":"5.15.105","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"6.1.22","lessThan":"6.1.189","versionType":"semver","status":"affected"},{"version":"5.10.177","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"6.2.9","lessThan":"6.3","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/eswitch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2196f9d3358b00fcb28835a5fde14071f51ecb96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/413e04adcc1fd263cf02b1b83b4a0dbdc66bcee9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5a2b87dfceccf9065157a14a599d395c2b6281b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/668e050429c7ca688cf4e7112f97f0cd269d446b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/69904608e25e8ba58111aadd9210892cf3876201","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72cfcb79026cffb6490f5044153a841d360b0cfc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0c6f4ba8a37688f7b4d4044898d88f0450d44c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98015","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:29.927","lastModified":"2026-10-19T10:17:55.007","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put\n\nIn mlx5_eswitch_termtbl_put(), the zero-ref cleanup check reads\ntt->ref_count after termtbl_mutex has been released.  Two concurrent\ncallers on the same mlx5_termtbl_handle race: one decrements ref_count\nto zero, removes the hash entry, and calls kfree(tt) while the other\nhas already dropped the mutex and is about to evaluate\nif (!tt->ref_count), producing a use-after-free.\n\nFix this by capturing the result of the decrement into a stack-local\nlast variable before dropping the mutex.  The cleanup decision is now\nmade entirely under termtbl_mutex, and tt is not touched after\nkfree."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"10caabdaad5ace85577a453da97d1f8d3b944427","lessThan":"e3ee194a790896fa92fea20b5385a354be2f2c12","versionType":"git","status":"affected"},{"version":"10caabdaad5ace85577a453da97d1f8d3b944427","lessThan":"b1398c9dfb5d3d4faaf6905ff7d98110a5d2c797","versionType":"git","status":"affected"},{"version":"10caabdaad5ace85577a453da97d1f8d3b944427","lessThan":"92f581cac93a71723456ac79ef54d9f60a251b42","versionType":"git","status":"affected"},{"version":"10caabdaad5ace85577a453da97d1f8d3b944427","lessThan":"a5833fdf53350b8b95a558fcf0056ddb1c0fe154","versionType":"git","status":"affected"},{"version":"10caabdaad5ace85577a453da97d1f8d3b944427","lessThan":"304ea40ef4561671503c36e47da44a0a31b71e36","versionType":"git","status":"affected"},{"version":"10caabdaad5ace85577a453da97d1f8d3b944427","lessThan":"e393789e92310d7c66f57c876101779c90816a12","versionType":"git","status":"affected"},{"version":"10caabdaad5ace85577a453da97d1f8d3b944427","lessThan":"18b2969073879b9cce24e1a78b118bdad54518d1","versionType":"git","status":"affected"},{"version":"10caabdaad5ace85577a453da97d1f8d3b944427","lessThan":"7ee07f601f8f507c9faf25c68a49396ab8950596","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/18b2969073879b9cce24e1a78b118bdad54518d1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/304ea40ef4561671503c36e47da44a0a31b71e36","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ee07f601f8f507c9faf25c68a49396ab8950596","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/92f581cac93a71723456ac79ef54d9f60a251b42","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a5833fdf53350b8b95a558fcf0056ddb1c0fe154","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1398c9dfb5d3d4faaf6905ff7d98110a5d2c797","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e393789e92310d7c66f57c876101779c90816a12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3ee194a790896fa92fea20b5385a354be2f2c12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98016","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:30.040","lastModified":"2026-10-19T10:17:55.230","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix use-after-free race in sample_restore_put()\n\nConcurrent teardown of TC sample rules sharing the same restore\ncontext may re-read restore->count after dropping restore_lock.\nAt that point another thread may already have completed cleanup and\nfreed the restore object.\n\nUse the result of the refcount decrement while holding restore_lock to\ndetermine whether cleanup is needed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/en/tc/sample.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"36a3196256bf3310e5e7142b0e61787f7a201abd","lessThan":"cdf920e44cbbee1900c66f002fb50afee20977d4","versionType":"git","status":"affected"},{"version":"36a3196256bf3310e5e7142b0e61787f7a201abd","lessThan":"308e1cbb0d9712081f90860fe839ccb47bc196ee","versionType":"git","status":"affected"},{"version":"36a3196256bf3310e5e7142b0e61787f7a201abd","lessThan":"8267e46d14e847e80e0aebe366d348e8a484a619","versionType":"git","status":"affected"},{"version":"36a3196256bf3310e5e7142b0e61787f7a201abd","lessThan":"3efd1a1938cbb33c53b0d75e55b6c0fe2ebad79a","versionType":"git","status":"affected"},{"version":"36a3196256bf3310e5e7142b0e61787f7a201abd","lessThan":"72324da8eeca269db9196c2a555abf72eb0385c5","versionType":"git","status":"affected"},{"version":"36a3196256bf3310e5e7142b0e61787f7a201abd","lessThan":"1daecd76ab9e5f055fe3970462410ad1d40bd177","versionType":"git","status":"affected"},{"version":"36a3196256bf3310e5e7142b0e61787f7a201abd","lessThan":"af3aef0245abbab5e9f6302e7a7d6407187afb71","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/en/tc/sample.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1daecd76ab9e5f055fe3970462410ad1d40bd177","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/308e1cbb0d9712081f90860fe839ccb47bc196ee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3efd1a1938cbb33c53b0d75e55b6c0fe2ebad79a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72324da8eeca269db9196c2a555abf72eb0385c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8267e46d14e847e80e0aebe366d348e8a484a619","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af3aef0245abbab5e9f6302e7a7d6407187afb71","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cdf920e44cbbee1900c66f002fb50afee20977d4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98017","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:30.147","lastModified":"2026-10-19T10:17:55.547","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: defer qdisc freeing after failed creation\n\nAn RTM_NEWQDISC request can make clsact bind a populated shared ingress\nblock during ->init(), publishing an embedded mini_Qdisc to lockless\nreaders.  If the same request has an invalid TCA_RATE, estimator setup\nfails after ->init(); the unwind removes the pointer but synchronously\nfrees its containing qdisc while tc_run() may still hold it.\n\nRetire failed qdiscs through the same RCU helper as normal destruction.\nInline the synchronous free into the callback now that no direct callers\nremain."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/sch_generic.h","net/sched/sch_api.c","net/sched/sch_generic.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"51ab2994c387c80b45caf8b8067b3f3b97771d25","lessThan":"96a27a3e64e7c87abade03fb2ad04ed66992a89a","versionType":"git","status":"affected"},{"version":"51ab2994c387c80b45caf8b8067b3f3b97771d25","lessThan":"6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d","versionType":"git","status":"affected"},{"version":"51ab2994c387c80b45caf8b8067b3f3b97771d25","lessThan":"20bf6fa34b345333971bd4464a322cce87b83f4e","versionType":"git","status":"affected"},{"version":"51ab2994c387c80b45caf8b8067b3f3b97771d25","lessThan":"156a3bab69744e9225bb9eff8c5cc53da18d5a2e","versionType":"git","status":"affected"},{"version":"51ab2994c387c80b45caf8b8067b3f3b97771d25","lessThan":"5bfe927c5b4b290fad529186218c728589b4b101","versionType":"git","status":"affected"},{"version":"51ab2994c387c80b45caf8b8067b3f3b97771d25","lessThan":"e6662f2100f8d33b0f4d0047c219efd6bba186ea","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/sch_generic.h","net/sched/sch_api.c","net/sched/sch_generic.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/156a3bab69744e9225bb9eff8c5cc53da18d5a2e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/20bf6fa34b345333971bd4464a322cce87b83f4e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5bfe927c5b4b290fad529186218c728589b4b101","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96a27a3e64e7c87abade03fb2ad04ed66992a89a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6662f2100f8d33b0f4d0047c219efd6bba186ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98018","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:30.257","lastModified":"2026-10-19T10:17:55.673","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mctp: i3c: serialize probe with bus removal\n\nmctp_i3c_probe() drops busdevs_lock after finding the matching bus. A\nconcurrent I3C_NOTIFY_BUS_REMOVE can then unregister and free the bus\nnetdev before probe passes its private data to mctp_i3c_add_device().\nThe latter consequently adds a list node through a freed mbus pointer.\n\nKeep busdevs_lock held until the device has been added. This also\nsatisfies the __must_hold annotation on mctp_i3c_add_device()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/mctp/mctp-i3c.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c8755b29b58ec65be17bcb8c40763d2dcb1f1db5","lessThan":"e6541b2747682fdb2c6ded4a7cf7c39c4067a35c","versionType":"git","status":"affected"},{"version":"c8755b29b58ec65be17bcb8c40763d2dcb1f1db5","lessThan":"765c5e357e67916a7aac8ead4ac2fa7d2bffe000","versionType":"git","status":"affected"},{"version":"c8755b29b58ec65be17bcb8c40763d2dcb1f1db5","lessThan":"906d8dbafabfa81a30e3ade420cb9912f223a5e1","versionType":"git","status":"affected"},{"version":"c8755b29b58ec65be17bcb8c40763d2dcb1f1db5","lessThan":"2b4707a149a55e8fa75c9ef32b359d60f470a566","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/mctp/mctp-i3c.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2b4707a149a55e8fa75c9ef32b359d60f470a566","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/765c5e357e67916a7aac8ead4ac2fa7d2bffe000","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/906d8dbafabfa81a30e3ade420cb9912f223a5e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6541b2747682fdb2c6ded4a7cf7c39c4067a35c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98019","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:30.363","lastModified":"2026-10-21T13:21:19.180","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: mark a NULL call argument precise\n\ncheck_func_arg() allows bpf_register_is_null() for nullable arguments\nw/o marking the underlying scalar register precise. Hence a checkpoint\ncreated on such a path would prune against arbitrary scalar value.\n\ncheck_helper_call() enforces second parameter of the\nbpf_get_local_storage() to be zero, w/o marking the underlying scalar\nregister precise. Hence a checkpoint created on such a path would\nprune against arbitrary scalar value.\n\nGrouping these two into one patch, as they share the same fixes tag."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c","tools/testing/selftests/bpf/progs/verifier_subprog_precision.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b5dc0163d8fd78e64a7e21f309cf932fda34353e","lessThan":"febbb66e682d8328f7c5bcbdd5e4291abab2e858","versionType":"git","status":"affected"},{"version":"b5dc0163d8fd78e64a7e21f309cf932fda34353e","lessThan":"627089c278df58749f25686c6a3caf7e181b5951","versionType":"git","status":"affected"},{"version":"b5dc0163d8fd78e64a7e21f309cf932fda34353e","lessThan":"b1fe6379e401b8ce0f561cb4d84af2b70b4343c3","versionType":"git","status":"affected"},{"version":"b5dc0163d8fd78e64a7e21f309cf932fda34353e","lessThan":"69a9ad004ccf5d45e534c7d503f47f643abe64b7","versionType":"git","status":"affected"},{"version":"b5dc0163d8fd78e64a7e21f309cf932fda34353e","lessThan":"1a3a10b030c96ea88868ccc060a16827c01eaa5a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c","tools/testing/selftests/bpf/progs/verifier_subprog_precision.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1a3a10b030c96ea88868ccc060a16827c01eaa5a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/627089c278df58749f25686c6a3caf7e181b5951","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/69a9ad004ccf5d45e534c7d503f47f643abe64b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1fe6379e401b8ce0f561cb4d84af2b70b4343c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/febbb66e682d8328f7c5bcbdd5e4291abab2e858","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98020","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:30.480","lastModified":"2026-10-19T10:17:55.857","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: fix cmd_regs access racing BAR unmap on reset\n\npdsc_reset_prepare() and pdsc_reset_done()'s pdsc_map_bars() error path\nclear/iounmap cmd_regs without devcmd_lock, and\npdsc_legacy_firmware_update()'s download loop derefs cmd_regs after\ndropping and retaking the lock without re-checking. An FLR concurrent\nwith a devlink flash can unmap cmd_regs under an in-flight devcmd,\ncausing a NULL deref or a write to unmapped MMIO.\n\nTake devcmd_lock across the BAR unmap/remap, and re-check cmd_regs in\nthe download loop. Only the PF maps cmd_regs and runs devcmd, so skip\nthe unmap on a VF, as pdsc_remove() and pdsc_reset_done() already do.\n\nA reset that completes entirely within the unlocked window is not a\ncorrectness problem for the image: the device clears its update session,\nso a resumed download is rejected, and it verifies the staged image\nbefore writing a flash slot, reporting PDS_RC_BAD_FW rather than\nactivating it.\n\npdsc_unmap_bars() also clears info_regs, intr_status and intr_ctrl. The\ninterrupt and start/stop readers of those are quiesced before the unmap\nby pdsc_fw_down(), which frees the interrupts and tears down the queues.\nThe debugfs readers are not, since those files outlive a reset; that is\npre-existing and out of scope here."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/amd/pds_core/fw.c","drivers/net/ethernet/amd/pds_core/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f6ec6ac9432941ec85a2221c91b1ecfc85680d89","lessThan":"0bf9f3bae3c4b1eadb7a2bf63350333db7dac0d9","versionType":"git","status":"affected"},{"version":"e96094c1d11cce4deb5da3c0500d49041ab845b8","lessThan":"2cc697565fd19b5ba2d100cdd4a20dd6d263abc2","versionType":"git","status":"affected"},{"version":"e96094c1d11cce4deb5da3c0500d49041ab845b8","lessThan":"fa31bd14c5042c6315bb2182c963f03ca6e79ca4","versionType":"git","status":"affected"},{"version":"e96094c1d11cce4deb5da3c0500d49041ab845b8","lessThan":"09f831bfe39de5b8026fefb3d106b5cc93272170","versionType":"git","status":"affected"},{"version":"e96094c1d11cce4deb5da3c0500d49041ab845b8","lessThan":"7980325b2f71e3f65c1323c39792e2455da6fab6","versionType":"git","status":"affected"},{"version":"692488941283d72362274620b9abd28109fc459f","versionType":"git","status":"affected"},{"version":"6.6.16","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.7.4","lessThan":"6.8","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/amd/pds_core/fw.c","drivers/net/ethernet/amd/pds_core/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/09f831bfe39de5b8026fefb3d106b5cc93272170","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0bf9f3bae3c4b1eadb7a2bf63350333db7dac0d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2cc697565fd19b5ba2d100cdd4a20dd6d263abc2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7980325b2f71e3f65c1323c39792e2455da6fab6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fa31bd14c5042c6315bb2182c963f03ca6e79ca4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98021","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:30.613","lastModified":"2026-10-21T13:21:19.287","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: reject oversized tx_queue_len at netlink parse time\n\nrtnl_create_link() assigns IFLA_TXQLEN directly to dev->tx_queue_len\nwithout going through netif_change_tx_queue_len(), so a device created\nwith \"ip link add ... txqueuelen 500000\" bypasses the S16_MAX cap and\nstill triggers the oversized ring allocations in pfifo_fast, tun and\ntap. The veth peer nest (rtnl_nla_parse_ifinfomsg()) and the\nRTM_NEWLINK-on-existing-device path reach the same sinks.\n\nEnforce the cap in ifla_policy instead: IFLA_TXQLEN becomes\nNLA_POLICY_FULL_RANGE(NLA_U32, &txqlen_range) with\ntxqlen_range = { .min = 0, .max = S16_MAX }. All netlink consumers\nparse against this policy - rtnl_setlink(), rtnl_newlink() (create\nand change), and the veth peer nest - so every netlink path is capped\nat parse time and rejects the attribute with -ERANGE plus a proper\n\"integer out of range\" extack message before any device state is\nmodified (the RTM_SETLINK half-application wart is gone with it).\n\nDocument the bound in the rt-link.yaml netlink spec.\n\nConditions to recreate the bug:\n- CONFIG_NET_SCHED=y, CONFIG_VETH=y, CONFIG_USER_NS=y, CONFIG_NET_NS=y.\n- Unprivileged user in a fresh user+net namespace (unshare -Urn):\n  ip link add v0 txqueuelen 500000 type veth peer name v1\n  -> on the fixed kernel this is rejected with -ERANGE (\"integer out\n  of range\" extack) instead of installing an oversized tx_queue_len\n  that later inflates pfifo_fast/tun/tap ring allocations.\n- ip link set v0 txqueuelen 500000 is likewise rejected at parse time."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["Documentation/netlink/specs/rt-link.yaml","net/core/rtnetlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"38f7b870d4a6a5d3ec21557e849620cb7d032965","lessThan":"26ee5f99ffe7ab98e635071290eff14192e9e34a","versionType":"git","status":"affected"},{"version":"38f7b870d4a6a5d3ec21557e849620cb7d032965","lessThan":"45ca9f59b6c7ea70e0a17054902b8a556913db34","versionType":"git","status":"affected"},{"version":"38f7b870d4a6a5d3ec21557e849620cb7d032965","lessThan":"2fd0880f0272ec022906a05587fd91416ebecc38","versionType":"git","status":"affected"},{"version":"38f7b870d4a6a5d3ec21557e849620cb7d032965","lessThan":"a638a2625aa83160a394abe8e8b2e524a80c771b","versionType":"git","status":"affected"},{"version":"38f7b870d4a6a5d3ec21557e849620cb7d032965","lessThan":"1aa9e143bf51405665a793d4cc925e1c4f0c5922","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["Documentation/netlink/specs/rt-link.yaml","net/core/rtnetlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.23","status":"affected"},{"version":"0","lessThan":"2.6.23","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1aa9e143bf51405665a793d4cc925e1c4f0c5922","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/26ee5f99ffe7ab98e635071290eff14192e9e34a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2fd0880f0272ec022906a05587fd91416ebecc38","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/45ca9f59b6c7ea70e0a17054902b8a556913db34","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a638a2625aa83160a394abe8e8b2e524a80c771b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98022","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:30.740","lastModified":"2026-10-19T10:17:56.067","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cap tx_queue_len at S16_MAX to prevent oversized ring allocations\n\nSeveral subsystems allocate ring buffers sized by dev->tx_queue_len\nwith no upper bound. An unprivileged user (via unshare -Urn) can set a\nhuge tx_queue_len and exhaust global memory with ring allocations:\n\n- pfifo_fast: pfifo_fast_init() and pfifo_fast_change_tx_queue_len()\n  allocate 3 skb_array rings of tx_queue_len entries each.\n- tun: tun_queue_resize() and the queue-attach path resize ptr_rings\n  to tx_queue_len on the NETDEV_CHANGE_TX_QUEUE_LEN notifier.\n- tap (macvtap/ipvtap): tap_queue_resize() and tap_init() resize/init\n  ptr_rings to tx_queue_len on the same notifier.\n\nnetif_change_tx_queue_len() is the single entry point for IFLA_TXQLEN,\nsysfs, and the SIOCSIFTXQLEN ioctl. Cap new_len at S16_MAX (32767)\nthere so the oversized value is rejected at set time. This takes\neffect whether the device is up or down, before dev->tx_queue_len is\nwritten, before any notifier fires, and before any ring is allocated.\nThe \"> S16_MAX\" check also subsumes the previous unsigned-long\ntruncation test, and a negative ifr_qlen from the ioctl lands far\nabove the cap after conversion, so both old failure modes are covered\nby the one comparison.\n\ntx_queue_len is ambigious: both a per-ring sizing multiplier and a\ndefault queue-length/limit knob for consumers that allocate\nnothing at set time (pfifo/bfifo/gred/plug/sfb limits, htb\ndirect_qlen, qfq max_classes, teql). 32767 is chosen as the largest\nvalue NLA_POLICY_FULL_RANGE can express for the u32 IFLA_TXQLEN\npolicy in patch 2/3 while staying a legitimate queue length on\nhigh-BDP paths; the ring-memory trade-off of a shared knob is\ndisclosed below.\n\nConditions to recreate the bug:\n- CONFIG_NET_SCHED=y, CONFIG_VETH=y, CONFIG_USER_NS=y, CONFIG_NET_NS=y.\n- Unprivileged user in a fresh user+net namespace (unshare -Urn).\n- pfifo_fast: create veth pairs, set tx_queue_len to 500000, attach\n  mq+pfifo_fast. ~28 iterations OOMs a 2GB guest.\n- tun: create 50 tun devices with IFF_MULTI_QUEUE, set tx_queue_len to\n  500000, open 8 queues each. ~1.6GB of ptr_ring allocations OOMs a\n  512MB guest.\n- tap: same as tun with IFF_TAP. ~960MB OOMs a 512MB guest.\n- On the fixed kernel the oversized tx_queue_len is rejected with\n  -ERANGE at set time (all four paths: RTM_SETLINK, RTM_NEWLINK\n  create, sysfs, ioctl - the latter two via this check, the former\n  two via this check and the 2/3 parse policy respectively)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/core/dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6a643ddb5624be7e0694d49f5765a8d41c1ab6d0","lessThan":"24d02c909a1725ab9eceb92db7d02e4e841f17ca","versionType":"git","status":"affected"},{"version":"6a643ddb5624be7e0694d49f5765a8d41c1ab6d0","lessThan":"5e5591a0f33f7c11bf1d338dbb6c5072575de64c","versionType":"git","status":"affected"},{"version":"6a643ddb5624be7e0694d49f5765a8d41c1ab6d0","lessThan":"c8d4060610c69645733c92d94fceb4b93808ac4d","versionType":"git","status":"affected"},{"version":"6a643ddb5624be7e0694d49f5765a8d41c1ab6d0","lessThan":"c2362c500931e5bd1826bce34e9ce28af80e7541","versionType":"git","status":"affected"},{"version":"6a643ddb5624be7e0694d49f5765a8d41c1ab6d0","lessThan":"81c0e02076989743a603806a5a4f44d2c40dc01f","versionType":"git","status":"affected"},{"version":"6a643ddb5624be7e0694d49f5765a8d41c1ab6d0","lessThan":"081340cf70a789b94b4174af54a63ffd49677a4e","versionType":"git","status":"affected"},{"version":"6a643ddb5624be7e0694d49f5765a8d41c1ab6d0","lessThan":"a03b927bae4af5c23fd5315a237855c17cc8f422","versionType":"git","status":"affected"},{"version":"6a643ddb5624be7e0694d49f5765a8d41c1ab6d0","lessThan":"66ab4c59b74db7ab53a1c9083feaaede393a96a0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/core/dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/081340cf70a789b94b4174af54a63ffd49677a4e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/24d02c909a1725ab9eceb92db7d02e4e841f17ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5e5591a0f33f7c11bf1d338dbb6c5072575de64c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/66ab4c59b74db7ab53a1c9083feaaede393a96a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81c0e02076989743a603806a5a4f44d2c40dc01f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a03b927bae4af5c23fd5315a237855c17cc8f422","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2362c500931e5bd1826bce34e9ce28af80e7541","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c8d4060610c69645733c92d94fceb4b93808ac4d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98023","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:30.873","lastModified":"2026-10-19T10:17:56.200","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: reject dynamic fdb entries that reference a nexthop id\n\nThe commit cited in the Fixes tag allowed VXLAN FDB entries to point to\nFDB nexthops so that overlay traffic could be load balanced across\nmultiple VTEPs. Such entries can only be configured from user space,\ncannot be learned and cannot roam. They only make sense with a user space\ncontrol plane such as E-VPN where data plane learning is disabled.\n\nDespite that, the VXLAN driver does not currently prevent such entries\nfrom being configured with the \"dynamic\" flag. The per-nexthop FDB list\nis only protected by the per-device hash lock, which is not sufficient\nwhen two VXLAN devices point to the same FDB nexthop and therefore share\nthe list. Aging runs in softirq context without RTNL, so an entry deleted\nby one device can race with an addition or deletion from the other,\nleading to list corruption:\n\n  list_del corruption. next->prev should be ffff8881069d9548, but was\n  dead000000000122. (next=ffff8881069d9448)\n  WARNING: CPU: 0 PID: 90 at lib/list_debug.c:65\n  __list_del_entry_valid_or_report+0x1aa/0x210\n  ...\n   vxlan_fdb_destroy+0x5b8/0xad0\n   vxlan_cleanup+0x328/0x450\n   call_timer_fn+0x2a/0x1c0\n   run_timer_softirq+0x18c/0x210\n  BUG: KASAN: slab-use-after-free in vxlan_fdb_destroy\n\nFix this by rejecting the bogus configuration of dynamic FDB entries that\npoint to FDB nexthops, both when created and when an existing entry is\nupdated. As such, the per-nexthop FDB list is only ever mutated under the\nRTNL lock. Add test cases to make sure that this does not regress in the\nfuture."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/vxlan/vxlan_core.c","tools/testing/selftests/net/fib_nexthops.sh"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1274e1cc42264d4e629841e4f182795cb0becfd2","lessThan":"00c7f4b8144e535ffb931ad45942a1bd1315b882","versionType":"git","status":"affected"},{"version":"1274e1cc42264d4e629841e4f182795cb0becfd2","lessThan":"55a33882808f1402052d53a08ead59aff8af18a1","versionType":"git","status":"affected"},{"version":"1274e1cc42264d4e629841e4f182795cb0becfd2","lessThan":"c8f29af91e0830fdabc9aa1eb1a0f898ce1bc603","versionType":"git","status":"affected"},{"version":"1274e1cc42264d4e629841e4f182795cb0becfd2","lessThan":"b2a8e165ddb6cd72176890b2954c52b0f6dbce1a","versionType":"git","status":"affected"},{"version":"1274e1cc42264d4e629841e4f182795cb0becfd2","lessThan":"28f86eec851b7406a4bc6143f82aeba2882d9842","versionType":"git","status":"affected"},{"version":"1274e1cc42264d4e629841e4f182795cb0becfd2","lessThan":"53359916ceb649b7e6947c8c2f669368a41c1354","versionType":"git","status":"affected"},{"version":"1274e1cc42264d4e629841e4f182795cb0becfd2","lessThan":"3fa64d86fc64eda104e3e97721a12a42a2fd2073","versionType":"git","status":"affected"},{"version":"1274e1cc42264d4e629841e4f182795cb0becfd2","lessThan":"98fc57d167446b95b4e719815fe79edef93f8e7a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/vxlan/vxlan_core.c","tools/testing/selftests/net/fib_nexthops.sh"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/00c7f4b8144e535ffb931ad45942a1bd1315b882","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/28f86eec851b7406a4bc6143f82aeba2882d9842","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3fa64d86fc64eda104e3e97721a12a42a2fd2073","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/53359916ceb649b7e6947c8c2f669368a41c1354","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55a33882808f1402052d53a08ead59aff8af18a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98fc57d167446b95b4e719815fe79edef93f8e7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2a8e165ddb6cd72176890b2954c52b0f6dbce1a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c8f29af91e0830fdabc9aa1eb1a0f898ce1bc603","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98024","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:30.997","lastModified":"2026-10-19T10:17:56.343","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ism: folio_put() after error\n\ndmb->cpu_addr was allocated via folio_alloc(). Use folio_put() instead of\nkfree() in the error exit of ism_alloc_dmb() to avoid slab allocator\ncorruption.\n\nWhile at it, reset dmb->cpu_addr after folio_put to avoid unintentional UAF\nby future callers."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/s390/net/ism_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"121fb75414ab8debafd548bded9d888cd5a8f165","lessThan":"90f6f5cb331af52b14c0f309fb27dc243e8e2982","versionType":"git","status":"affected"},{"version":"83781384a96b95e2b6403d3c8a002b2c89031770","lessThan":"890e2ef726904d1d8328e4b9f5090eeb8761b9d1","versionType":"git","status":"affected"},{"version":"83781384a96b95e2b6403d3c8a002b2c89031770","lessThan":"eebb6a9017b55ac05be770cf7b89f9da49505ae7","versionType":"git","status":"affected"},{"version":"83781384a96b95e2b6403d3c8a002b2c89031770","lessThan":"60983356fab0c1171c5cb1b56a36349ebadc608e","versionType":"git","status":"affected"},{"version":"83781384a96b95e2b6403d3c8a002b2c89031770","lessThan":"907a56ab3eb8a58500a58daa76087f17bb2b6826","versionType":"git","status":"affected"},{"version":"f3e23edc4917f72139b805f208aeadf23376a0b5","versionType":"git","status":"affected"},{"version":"6.6.29","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.8.8","lessThan":"6.9","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/s390/net/ism_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/60983356fab0c1171c5cb1b56a36349ebadc608e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/890e2ef726904d1d8328e4b9f5090eeb8761b9d1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/907a56ab3eb8a58500a58daa76087f17bb2b6826","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/90f6f5cb331af52b14c0f309fb27dc243e8e2982","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eebb6a9017b55ac05be770cf7b89f9da49505ae7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98025","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:31.110","lastModified":"2026-10-19T10:17:56.440","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow\n\nThe 0xffff length sentinel detects a router reboot and schedules\nre-enabling of ethernet mode, but then falls through to the rest\nof the loop body.  The next check is\n\n\t} else if (len > CX82310_MTU) {\n\nwhich is the else of the just-matched if -- it never fires for\nlen == 0xffff.  The MTU bound that normally caps the\nincomplete-packet save path is silently bypassed.\n\nWith 0xffff > skb->len always true (rx_urb_size is 4096), the\nincomplete-packet branch saves dev->partial_len = skb->len bytes\ninto dev->partial_data.  partial_data is kmalloc(hard_mtu) =\nkmalloc(CX82310_MTU + 2) = 1516 bytes, but skb->len after the\n2-byte header pull can be up to 4094.  A device that sends a\n4096-byte URB starting with [0xff 0xff] therefore copies 4094\ndevice-provided bytes into a buffer allocated for 1516 bytes,\nexceeding its requested size by 2578 bytes.\n\nThe next URB then reads dev->partial_len (4094) back from the same\n1516-byte buffer and dev->partial_rem (65535 - 4094 = 61441) from\nthe new URB's ~4KB skb, both well past their allocations, and\ndelivers the spliced result as a 64KB \"frame\" to the network\nstack.\n\nBail out of rx_fixup after scheduling the re-enable work; the\nremainder of a reboot-marker URB is not meaningful packet data.\nThis restores the invariant that partial_len < CX82310_MTU + 2 on\nthe save path, since every other route there has already passed\nthe MTU check."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/usb/cx82310_eth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808","lessThan":"d0c1ce6ef4cefe568e19afa83f543caa3c3c0873","versionType":"git","status":"affected"},{"version":"ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808","lessThan":"0dbc89e664b4609ad672b5bdeef60df251294b8f","versionType":"git","status":"affected"},{"version":"ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808","lessThan":"00520cdd21ea6a9b5dc8d53bbd241620d2059554","versionType":"git","status":"affected"},{"version":"ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808","lessThan":"59bf9e94bdc49557f07d87164269daff7340f4d6","versionType":"git","status":"affected"},{"version":"ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808","lessThan":"3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287","versionType":"git","status":"affected"},{"version":"ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808","lessThan":"659654654eb140851467af41d610473c100c7975","versionType":"git","status":"affected"},{"version":"ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808","lessThan":"237c9ae7145772af147e4665f158938350fa5658","versionType":"git","status":"affected"},{"version":"ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808","lessThan":"5d50e90add8b4a978395e893e81954d19d58a7c5","versionType":"git","status":"affected"},{"version":"5adf7fbdfa3e9e425b04771e1d64c4e184ad8fdb","versionType":"git","status":"affected"},{"version":"c1b187a86a176e42f5e48066556980e3232b6cab","versionType":"git","status":"affected"},{"version":"4.19.322","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.284","lessThan":"5.5","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/usb/cx82310_eth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/00520cdd21ea6a9b5dc8d53bbd241620d2059554","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0dbc89e664b4609ad672b5bdeef60df251294b8f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/237c9ae7145772af147e4665f158938350fa5658","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59bf9e94bdc49557f07d87164269daff7340f4d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d50e90add8b4a978395e893e81954d19d58a7c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/659654654eb140851467af41d610473c100c7975","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0c1ce6ef4cefe568e19afa83f543caa3c3c0873","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98026","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:31.230","lastModified":"2026-10-19T10:17:56.560","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mcast: properly convert mglist to rcu\n\nSashiko reported a bug [1] that br_multicast_del_port_group unlists the\nport group not using proper rcu helper that preserves the next pointer and\nafter that immediately frees the port group without waiting for rcu grace\nperiod. The only rcu walker of mglist is br_multicast_list_adjacent() and\nit turns out that function has always been buggy because mglist was never\nproperly converted to RCU. Fix it by converting it to rcu and moving its\ninitialization after eth_addr's. Initializing p->next can use\nRCU_INIT_POINTER because we have a barrier from the hlist_add_head_rcu call\nlater, besides we're initializing an unpublished structure anyway.\n\n[1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826014200.362304-1-littleddfu%40gmail.com"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bridge/br_multicast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"07f8ac4a1e26e8283542cdaf658a6e2a12fd6980","lessThan":"37cb9a81600da8250f24e25edc07253b62353cbe","versionType":"git","status":"affected"},{"version":"07f8ac4a1e26e8283542cdaf658a6e2a12fd6980","lessThan":"98247c8264d2076f81fa114bdfa2c2271953ac7c","versionType":"git","status":"affected"},{"version":"07f8ac4a1e26e8283542cdaf658a6e2a12fd6980","lessThan":"38ab2a435001a3c4dbeb70a52f5921e1ccd66f55","versionType":"git","status":"affected"},{"version":"07f8ac4a1e26e8283542cdaf658a6e2a12fd6980","lessThan":"f7bf57e94a5d6214b87be08486cb33836fbfa573","versionType":"git","status":"affected"},{"version":"07f8ac4a1e26e8283542cdaf658a6e2a12fd6980","lessThan":"4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bridge/br_multicast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.16","status":"affected"},{"version":"0","lessThan":"3.16","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/37cb9a81600da8250f24e25edc07253b62353cbe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38ab2a435001a3c4dbeb70a52f5921e1ccd66f55","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98247c8264d2076f81fa114bdfa2c2271953ac7c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f7bf57e94a5d6214b87be08486cb33836fbfa573","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98027","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:31.340","lastModified":"2026-10-19T10:17:56.653","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size\n\nmv88e6xxx_get_rxnfc() uses rxnfc->rule_cnt as the write index while\ndumping the policy IDR, clobbering the input value before it has been\nlooked at.  That input is the number of entries the caller had room for.\nETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the\nbuffer from the rule_cnt userspace passes in, so once an admin has\ninstalled policy rules any user can ask for fewer slots than there are\nrules and run off the end of the allocation.  A rule_cnt of 0 leaves the\nbuffer pointer NULL and the walk dereferences it.\n\nCount into a local so the caller's limit survives the walk, and stop with\n-EMSGSIZE once it is reached."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/dsa/mv88e6xxx/chip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"da7dc87553046a43be1620a783ce3d9f6583d322","lessThan":"7e4bfc5f0b66feb22cba821303fc25ca22cd0887","versionType":"git","status":"affected"},{"version":"da7dc87553046a43be1620a783ce3d9f6583d322","lessThan":"01124cd2cf4b71755b1130ac82d78dcfbd5d69e3","versionType":"git","status":"affected"},{"version":"da7dc87553046a43be1620a783ce3d9f6583d322","lessThan":"609c4378f212cf580aae02250f1146caf63d873f","versionType":"git","status":"affected"},{"version":"da7dc87553046a43be1620a783ce3d9f6583d322","lessThan":"c5b5c52b6524c9fb50def2260baac745c095ec3a","versionType":"git","status":"affected"},{"version":"da7dc87553046a43be1620a783ce3d9f6583d322","lessThan":"44cd4674d9aa5bdf793b8a8b481c9e8536ed6070","versionType":"git","status":"affected"},{"version":"da7dc87553046a43be1620a783ce3d9f6583d322","lessThan":"7a683c2b062810bca203e41866389daf387c235b","versionType":"git","status":"affected"},{"version":"da7dc87553046a43be1620a783ce3d9f6583d322","lessThan":"cda5ac8fe8ac8e80b1703ebb8c4250726fc19739","versionType":"git","status":"affected"},{"version":"da7dc87553046a43be1620a783ce3d9f6583d322","lessThan":"b1fffc273112e7284c5b705e186b43b5770cd3d5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/dsa/mv88e6xxx/chip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/01124cd2cf4b71755b1130ac82d78dcfbd5d69e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/44cd4674d9aa5bdf793b8a8b481c9e8536ed6070","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/609c4378f212cf580aae02250f1146caf63d873f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a683c2b062810bca203e41866389daf387c235b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e4bfc5f0b66feb22cba821303fc25ca22cd0887","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1fffc273112e7284c5b705e186b43b5770cd3d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c5b5c52b6524c9fb50def2260baac745c095ec3a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cda5ac8fe8ac8e80b1703ebb8c4250726fc19739","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98028","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:31.447","lastModified":"2026-10-19T10:17:56.787","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\neth: nfp: drop the replaced rule from the list when reprogramming fails\n\nnfp_net_fs_add() replaces an existing rule by deleting it from the\nhardware, decrementing nn->fs.count and programming the new one.  If\nnfp_net_fs_add_hw() fails the old entry stays on nn->fs.list - only the\nsuccess path reaches list_replace() - so the list is one longer than\nnn->fs.count, and it advertises a rule whose hardware entry has already\nbeen torn down.\n\nnn->fs.count is what ETHTOOL_GRXCLSRLCNT reports, so userspace then sizes\nits buffer one entry short of what the GRXCLSRLALL walk wants to write.\nThat used to overwrite one u32 past the allocation; since the walk is\nbounded it is a permanent -EMSGSIZE instead, as nothing ever resyncs the\ncounter."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9eb03bb1c035ff6e2c3a34046419446588253dda","lessThan":"603b70093f729f52a37544b48679903cad834856","versionType":"git","status":"affected"},{"version":"9eb03bb1c035ff6e2c3a34046419446588253dda","lessThan":"edaec279f59f801a05b751df475ed71a0a68c88a","versionType":"git","status":"affected"},{"version":"9eb03bb1c035ff6e2c3a34046419446588253dda","lessThan":"552e528a7d85cbe088b2ae4f78194713975b46cf","versionType":"git","status":"affected"},{"version":"9eb03bb1c035ff6e2c3a34046419446588253dda","lessThan":"108bb2142e3a12c9ad625ad662973127a113ddc6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/108bb2142e3a12c9ad625ad662973127a113ddc6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/552e528a7d85cbe088b2ae4f78194713975b46cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/603b70093f729f52a37544b48679903cad834856","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/edaec279f59f801a05b751df475ed71a0a68c88a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98029","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:31.560","lastModified":"2026-10-19T10:17:56.877","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\neth: nfp: bound the ntuple rule dump by the caller's buffer size\n\nnfp_net_get_fs_loc() dumps every entry of nn->fs.list into rule_locs[]\nwithout consulting cmd->rule_cnt, which is how many entries the caller\nhad room for.  ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the\nioctl sizes the buffer from the rule_cnt userspace passes in, so once an\nadmin has installed flow steering rules any user can ask for fewer slots\nthan there are rules and run off the end of the allocation.  A rule_cnt\nof 0 leaves the buffer pointer NULL and the walk dereferences it.\n\nBail out with -EMSGSIZE when the buffer fills up, the way the other\nntuple capable drivers do, and report how many locations were filled so\na shrinking rule list does not leave the caller reading stale slots."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9eb03bb1c035ff6e2c3a34046419446588253dda","lessThan":"82812583b9c69c241da6da4186f14e9df2516488","versionType":"git","status":"affected"},{"version":"9eb03bb1c035ff6e2c3a34046419446588253dda","lessThan":"a7e023c63e855761c1426cee8d17c2bca32aa339","versionType":"git","status":"affected"},{"version":"9eb03bb1c035ff6e2c3a34046419446588253dda","lessThan":"ecebfdaab72a504c10f4907bd00fc3b705ec3b12","versionType":"git","status":"affected"},{"version":"9eb03bb1c035ff6e2c3a34046419446588253dda","lessThan":"f1986bf87b0709c95126fe196cf39e5b8c8453a1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/82812583b9c69c241da6da4186f14e9df2516488","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a7e023c63e855761c1426cee8d17c2bca32aa339","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ecebfdaab72a504c10f4907bd00fc3b705ec3b12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1986bf87b0709c95126fe196cf39e5b8c8453a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98030","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:31.673","lastModified":"2026-10-19T10:17:56.990","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting nfc->rule_cnt, which is how many entries\nthe caller had room for.  ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN\nand the ioctl sizes the buffer from the rule_cnt userspace passes in, so\nonce an admin has installed CFP rules any user can ask for fewer slots\nthan there are rules and run off the end of the allocation.  A rule_cnt\nof 0 leaves the buffer pointer NULL and the walk dereferences it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/dsa/bcm_sf2_cfp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7318166cacad158b46240f66250d7cc5a481653b","lessThan":"ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e","versionType":"git","status":"affected"},{"version":"7318166cacad158b46240f66250d7cc5a481653b","lessThan":"8e41ce02589c92356bfd8ef62f6ceff840546e1a","versionType":"git","status":"affected"},{"version":"7318166cacad158b46240f66250d7cc5a481653b","lessThan":"f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4","versionType":"git","status":"affected"},{"version":"7318166cacad158b46240f66250d7cc5a481653b","lessThan":"f5e93162b3dd195bfda815e8f7a39aaf1d45437b","versionType":"git","status":"affected"},{"version":"7318166cacad158b46240f66250d7cc5a481653b","lessThan":"f1a2869b3629c0e8394b77b38cb9f19a018c653c","versionType":"git","status":"affected"},{"version":"7318166cacad158b46240f66250d7cc5a481653b","lessThan":"fd1a78c16b1f6978c09cf048e15f349732e4c707","versionType":"git","status":"affected"},{"version":"7318166cacad158b46240f66250d7cc5a481653b","lessThan":"b231b6d8516d3fe0d4bba549908e08d26a4531a5","versionType":"git","status":"affected"},{"version":"7318166cacad158b46240f66250d7cc5a481653b","lessThan":"cdb719f4b8596d9ccee2d56d204c2c4dce982f46","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/dsa/bcm_sf2_cfp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.11","status":"affected"},{"version":"0","lessThan":"4.11","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/8e41ce02589c92356bfd8ef62f6ceff840546e1a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5e93162b3dd195bfda815e8f7a39aaf1d45437b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98031","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:31.787","lastModified":"2026-10-19T10:17:57.120","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: Initialize extack in remove_nh_grp_entry()\n\nremove_nh_grp_entry() prints the extack message when a listener fails\nto replace the reduced nexthop group. However, extack is not\ninitialized and listeners are not required to set a message when\nreturning an error. Neither netdevsim nor mlxsw do so when an\nallocation fails, resulting in the dereference of an uninitialized\nstack pointer.\n\nFix by zero-initializing extack, as was done in commit 6347c5314cee\n(\"nexthop: initialize extack in nh_res_bucket_migrate()\")."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/nexthop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"833a1065eeb14437a9a0dfa9dad06ea09894e0b5","lessThan":"35d9ec61466109ef0c2de87067338d929f629527","versionType":"git","status":"affected"},{"version":"833a1065eeb14437a9a0dfa9dad06ea09894e0b5","lessThan":"704319510af2179cf03955747d714ab291075c25","versionType":"git","status":"affected"},{"version":"833a1065eeb14437a9a0dfa9dad06ea09894e0b5","lessThan":"17acbcd4c5a6ca3dd3f9e52eb203c9175bde609a","versionType":"git","status":"affected"},{"version":"833a1065eeb14437a9a0dfa9dad06ea09894e0b5","lessThan":"030c878eaedf0449e2b5401a0a0146d0afcc645e","versionType":"git","status":"affected"},{"version":"833a1065eeb14437a9a0dfa9dad06ea09894e0b5","lessThan":"d643cea4248668dc493c513aa7cbc6505eb1a4a9","versionType":"git","status":"affected"},{"version":"833a1065eeb14437a9a0dfa9dad06ea09894e0b5","lessThan":"d80677ad7aa5bebfccfd58caa4852b65abe70561","versionType":"git","status":"affected"},{"version":"833a1065eeb14437a9a0dfa9dad06ea09894e0b5","lessThan":"5bd9e4e7cdaa03879e9b73b12ab52cceb1edd55b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/nexthop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/030c878eaedf0449e2b5401a0a0146d0afcc645e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/17acbcd4c5a6ca3dd3f9e52eb203c9175bde609a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/35d9ec61466109ef0c2de87067338d929f629527","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5bd9e4e7cdaa03879e9b73b12ab52cceb1edd55b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/704319510af2179cf03955747d714ab291075c25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d643cea4248668dc493c513aa7cbc6505eb1a4a9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d80677ad7aa5bebfccfd58caa4852b65abe70561","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98032","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:31.900","lastModified":"2026-10-21T13:21:19.397","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix subbuf resize races with trace_pipe_raw readers\n\nConcurrent subbuffer resizes may crash trace_pipe_raw readers or leak\nuninitialized memory to userspace due to stale size values.\n\nModify ring_buffer_alloc_read_page() to handle the resizing of an\nexisting buffer_data_read_page if necessary and add a new\nring_buffer_read_page_size(). This new function enables ring-buffer\nbuffer_data_read_page users to not call the racy\nring_buffer_subbuf_size_get(). This makes the spare_size member of\nftrace_buffer_info redundant.\n\nFinally, handle buffer_data_read_page/reader_page order discrepancy in\nring_buffer_read_page(). On a mismatch simply copy manually the data to\nthe buffer_data_read_page."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/ring_buffer.h","kernel/trace/ring_buffer.c","kernel/trace/ring_buffer_benchmark.c","kernel/trace/trace.c","kernel/trace/trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bce761d757452ba5eb77e11fecc37a04b67494e7","lessThan":"574efd988d116bd56ac688ab2d64e06ba0da982a","versionType":"git","status":"affected"},{"version":"bce761d757452ba5eb77e11fecc37a04b67494e7","lessThan":"3f30b2cd4eba45c05f822f03f1b0f4077d6d4dc3","versionType":"git","status":"affected"},{"version":"bce761d757452ba5eb77e11fecc37a04b67494e7","lessThan":"75b37b8369778b69ce9738d1c97685a1615cb252","versionType":"git","status":"affected"},{"version":"bce761d757452ba5eb77e11fecc37a04b67494e7","lessThan":"dae8dda341d2d9034a90d59e8a7d502e1263813f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/ring_buffer.h","kernel/trace/ring_buffer.c","kernel/trace/ring_buffer_benchmark.c","kernel/trace/trace.c","kernel/trace/trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3f30b2cd4eba45c05f822f03f1b0f4077d6d4dc3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/574efd988d116bd56ac688ab2d64e06ba0da982a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/75b37b8369778b69ce9738d1c97685a1615cb252","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dae8dda341d2d9034a90d59e8a7d502e1263813f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98033","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:32.003","lastModified":"2026-10-21T13:21:19.500","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve inner map identity in callback frames\n\nCallback frame constructors initialize map-typed argument registers with\n__mark_reg_known_zero() and then restore map_ptr. This clears map_uid,\nwhich is the only field distinguishing inner maps that share an\ninner_map_meta template.\n\nWhen a timer callback invokes bpf_for_each_map_elem() on a second inner\nmap, both the saved first map and the second map value can reach the nested\ncallback as the same template with map_uid zero. bpf_timer_init() then\naccepts pairing the timer from the second map with the first map.\n\nThe runtime records the first map in the timer without taking a reference.\nFreeing that map does not find the timer stored in the second map, so a\nlater timer callback dereferences the freed map.\n\nCopy map_uid from the same caller register as map_ptr when constructing\nfor-each, timer/workqueue, and task-work callback arguments. The existing\nidentity check can then reject mismatched inner maps while allowing a\ncallback value to be paired with its actual map."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"69c087ba6225b574afb6e505b72cb75242a3d844","lessThan":"cf85e4f94d7feef8b3c4c90dbe2468595a48393b","versionType":"git","status":"affected"},{"version":"69c087ba6225b574afb6e505b72cb75242a3d844","lessThan":"166221c52d3ca332f8699a854efca8e2704bb137","versionType":"git","status":"affected"},{"version":"69c087ba6225b574afb6e505b72cb75242a3d844","lessThan":"08b534bafdd9de65b6374474a8fe719c90eb3b01","versionType":"git","status":"affected"},{"version":"69c087ba6225b574afb6e505b72cb75242a3d844","lessThan":"66ff2eff093d2a0838f39c713eeb590bc0946c2a","versionType":"git","status":"affected"},{"version":"69c087ba6225b574afb6e505b72cb75242a3d844","lessThan":"b90c5d770dad910fb89e6c1b15052a8a1e8db752","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/08b534bafdd9de65b6374474a8fe719c90eb3b01","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/166221c52d3ca332f8699a854efca8e2704bb137","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/66ff2eff093d2a0838f39c713eeb590bc0946c2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b90c5d770dad910fb89e6c1b15052a8a1e8db752","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf85e4f94d7feef8b3c4c90dbe2468595a48393b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98034","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:32.123","lastModified":"2026-10-21T13:21:19.607","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark NULL kptr stores precise\n\ncheck_map_kptr_access() permits a scalar store into an untrusted kptr\nfield only when the register is known to contain zero. Unlike other\nverifier checks whose outcome depends on a scalar value, it does not mark\nthat register precise.\n\nA state checkpoint reached with an imprecise zero can therefore prune a\nsecond path that reaches the store with an arbitrary nonzero scalar. The\nprogram can write attacker-controlled bits into the kptr field and load\nthem back as a PTR_TO_BTF_ID.\n\nCall mark_chain_precision() before accepting a known-zero register. This\nforces state equivalence to compare its scalar range and makes the verifier\nvisit and reject a path carrying a nonzero value."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"61df10c7799e27807ad5e459eec9d77cddf8bf45","lessThan":"86a3171c90bfc35a54e9d83cd197ca0d72d2f4e4","versionType":"git","status":"affected"},{"version":"61df10c7799e27807ad5e459eec9d77cddf8bf45","lessThan":"b8b98d3d37908402ff63515fa4d7574235436ea8","versionType":"git","status":"affected"},{"version":"61df10c7799e27807ad5e459eec9d77cddf8bf45","lessThan":"bb667eb575c906f24c707986541a99424c5b07ea","versionType":"git","status":"affected"},{"version":"61df10c7799e27807ad5e459eec9d77cddf8bf45","lessThan":"86168208737bdd267d92d855d453d1d2f840df19","versionType":"git","status":"affected"},{"version":"61df10c7799e27807ad5e459eec9d77cddf8bf45","lessThan":"ecdc5043794c9184aa8e6c814603899479c46b35","versionType":"git","status":"affected"},{"version":"b5a8069835e5236824a84281592d29f859b33153","versionType":"git","status":"affected"},{"version":"5.18.18","lessThan":"5.19","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/86168208737bdd267d92d855d453d1d2f840df19","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/86a3171c90bfc35a54e9d83cd197ca0d72d2f4e4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8b98d3d37908402ff63515fa4d7574235436ea8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb667eb575c906f24c707986541a99424c5b07ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ecdc5043794c9184aa8e6c814603899479c46b35","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98035","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:32.237","lastModified":"2026-10-19T10:17:57.480","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Cancel special fields when recycling rhtab elements\n\nrhtab_map_update_existing() and rhtab_delete_elem() call\nbpf_obj_free_fields() when replacing or deleting a value. These map\noperations can run from BPF programs in NMI context, where releasing a\nreferenced kptr or another complex field is not generally safe.\n\nArray and hash maps avoid that problem by cancelling only the asynchronous\nfields which can be stopped safely in the caller context. Other ownership\nstate remains attached to the allocation until its memory allocator\ndestructor performs the final cleanup.\n\nUse bpf_obj_cancel_fields() for the corresponding rhtab paths as well. This\ncancels timers, workqueues, and task work while allowing rhtab_mem_dtor() to\nrelease referenced kptrs when the allocation is eventually destroyed.\n\n[ kkd: Rebased, used direct helper calls, and rewrote the commit log ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/hashtab.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6905f8601298ecd2d1932a4b4849bf265201118e","lessThan":"28fde1356dbc35e20a9f22a5ee65af09698fdf92","versionType":"git","status":"affected"},{"version":"6905f8601298ecd2d1932a4b4849bf265201118e","lessThan":"65cc95eba9e8b46312cac38c227473605a4b996a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/hashtab.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/28fde1356dbc35e20a9f22a5ee65af09698fdf92","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65cc95eba9e8b46312cac38c227473605a4b996a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98036","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:32.340","lastModified":"2026-10-19T10:17:57.567","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve special fields in recycled rhtab elements\n\nrhtab_map_update_elem() initializes special fields after obtaining an\nelement from bpf_mem_cache_alloc(). The allocator can return a fresh,\nzeroed unit, or recycle one from its RCU-pending lists before the\nregistered destructor has run.\n\nA BPF program can retain a map-value pointer after deleting its element\nand initialize and arm a timer through that pointer. If the deleted unit\nis recycled, check_and_init_map_value() clears the only pointer to the\ntimer. Neither a later deletion nor rhtab_mem_dtor() can then cancel it,\nand the callback can run with its key and value pointing into freed memory.\n\nDo not reinitialize special fields on insertion. Fresh allocator units are\nalready zeroed. For recycled units, the special fields are ownership state\nthat must remain visible to the eventual destructor. copy_map_value()\nalready skips those fields, matching the non-preallocated hash-map path and\nthe lifecycle established by commit 275c30bcee66 (\"bpf: Don't reinit map\nvalue in prealloc_lru_pop\").\n\n[ kkd: Split out the fix and rewrote the commit log ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/hashtab.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6905f8601298ecd2d1932a4b4849bf265201118e","lessThan":"6a5266b8288216b86602ff687d528abfb066dfd8","versionType":"git","status":"affected"},{"version":"6905f8601298ecd2d1932a4b4849bf265201118e","lessThan":"5df46ddcb7b36878c1b691e9057a0509042a2567","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/hashtab.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5df46ddcb7b36878c1b691e9057a0509042a2567","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6a5266b8288216b86602ff687d528abfb066dfd8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98037","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:32.443","lastModified":"2026-10-19T10:17:57.647","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject untrusted allocated-object pointers\n\nWhen the final RCU read-side critical section ends, a local kptr is demoted\nto PTR_UNTRUSTED but retains MEM_ALLOC. The pointer may be NULL or may refer\nto an object whose lifetime is no longer protected.\n\ntype_is_ptr_alloc_obj() nevertheless recognizes any PTR_TO_BTF_ID with\nMEM_ALLOC as a live allocated object. In particular, a refcount-only local\nkptr never carries NON_OWN_REF, so it still passes the\nbpf_refcount_acquire() argument check after RCU protection ends. The kfunc\ncan then dereference NULL or stale memory.\n\nMake type_is_ptr_alloc_obj() reject PTR_UNTRUSTED pointers. Since\ntype_is_non_owning_ref() is based on the same predicate, graph kfunc\narguments obey the same live-object requirement. Fault-protected reads of\nthe demoted pointer remain valid: writes are already rejected, and read\nfixups use bpf_may_fault_on_deref() rather than this predicate.\n\n[ kkd: Rewrote commit log ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/bpf_verifier.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1b12171533a9bb23cf6fba7262b479028b65e1e8","lessThan":"092c2874dc1b2060fa77a465a971acd4fdf87683","versionType":"git","status":"affected"},{"version":"1b12171533a9bb23cf6fba7262b479028b65e1e8","lessThan":"135d542b97fa93e32c457d49d6e7b33ca7d05bae","versionType":"git","status":"affected"},{"version":"1b12171533a9bb23cf6fba7262b479028b65e1e8","lessThan":"6b1f786ad85a0b63393b76f5e634deab1a73198c","versionType":"git","status":"affected"},{"version":"1b12171533a9bb23cf6fba7262b479028b65e1e8","lessThan":"7441ee8276641bddaf1cba7bb75ef9c1458ceb3b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/bpf_verifier.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/092c2874dc1b2060fa77a465a971acd4fdf87683","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/135d542b97fa93e32c457d49d6e7b33ca7d05bae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b1f786ad85a0b63393b76f5e634deab1a73198c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7441ee8276641bddaf1cba7bb75ef9c1458ceb3b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98038","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:32.560","lastModified":"2026-10-21T13:21:19.710","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Keep refcount_acquire nullable for borrowed RCU kptrs\n\nbpf_refcount_acquire() is fallible for a borrowed reference because the\nobject may have reached a zero refcount. The verifier therefore keeps\nKF_RET_NULL on the return value unless the argument is an owning reference.\n\nAn RCU-protected load of a local kptr is marked MEM_ALLOC, but it only\nreceives NON_OWN_REF when the pointee contains a graph node. A refcounted\nobject without a graph node consequently looks like an owning reference\neven though the loaded register has no acquired reference state. If the\nprogram drops the last real reference while remaining in the RCU critical\nsection, refcount_inc_not_zero() returns NULL while the verifier treats the\nresult as non-NULL.\n\nOnly classify the argument as owning when it is backed by a verifier-tracked\nreference. This retains the non-NULL return for pointers from bpf_obj_new(),\nbpf_kptr_xchg(), or an earlier successful acquisition, while requiring a\nNULL check for borrowed RCU kptrs.\n\n[ kkd: Rewrote commit log ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1b12171533a9bb23cf6fba7262b479028b65e1e8","lessThan":"85bfc8b6db43502444c428eaa2de20bdd2fb9064","versionType":"git","status":"affected"},{"version":"1b12171533a9bb23cf6fba7262b479028b65e1e8","lessThan":"8d19e2cdfba9ba8c8eb6a459cd666bec00a1d2c6","versionType":"git","status":"affected"},{"version":"1b12171533a9bb23cf6fba7262b479028b65e1e8","lessThan":"85074498228a2500ea8b8039c49cc1ab8ad5328f","versionType":"git","status":"affected"},{"version":"1b12171533a9bb23cf6fba7262b479028b65e1e8","lessThan":"dc36739e5cc9f60485418a910b42bc95339218d2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/85074498228a2500ea8b8039c49cc1ab8ad5328f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/85bfc8b6db43502444c428eaa2de20bdd2fb9064","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8d19e2cdfba9ba8c8eb6a459cd666bec00a1d2c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc36739e5cc9f60485418a910b42bc95339218d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98039","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:32.663","lastModified":"2026-10-19T10:17:57.823","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Require MEM_PERCPU for percpu kptr stores\n\nmap_kptr_match_type() treats perm_flags as the set of register type flags\nthat a kptr field permits. Adding MEM_PERCPU to that set for\nBPF_KPTR_PERCPU does not require the source register to carry it, however.\nThe subset test consequently accepts both a plain bpf_obj_new() allocation\nand a referenced kernel pointer into a __percpu_kptr map field.\n\nLoads from the field are always marked MEM_PERCPU. Consumers then treat the\nstored value as the cookie returned by bpf_percpu_obj_new(): per-CPU pointer\nhelpers relocate it, and map teardown selects the per-CPU free path. A plain\nallocation can therefore provide an arbitrary kernel read/write, while a\nkernel pointer can be relocated into an invalid address or sent through a\nmissing destructor.\n\nRequire the source MEM_PERCPU flag to match the destination field kind.\nThis preserves valid bpf_percpu_obj_new() stores and rejects both the\nprogram-BTF and kernel-BTF variants."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"36d8bdf75a93190e5669b9d1d95994e13e15ba1d","lessThan":"aaa9cf7707d1c5c0d2ca9d40c8b71652ac1c3c3f","versionType":"git","status":"affected"},{"version":"36d8bdf75a93190e5669b9d1d95994e13e15ba1d","lessThan":"0bdd6121c8dd5f1764efe701ce26bb8e15acb172","versionType":"git","status":"affected"},{"version":"36d8bdf75a93190e5669b9d1d95994e13e15ba1d","lessThan":"ad4ebae5dbc2d47b544aa54f03c12490065be08a","versionType":"git","status":"affected"},{"version":"36d8bdf75a93190e5669b9d1d95994e13e15ba1d","lessThan":"048029ba1c793f8cabc4ad5eea765da01903f8f1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/048029ba1c793f8cabc4ad5eea765da01903f8f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0bdd6121c8dd5f1764efe701ce26bb8e15acb172","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aaa9cf7707d1c5c0d2ca9d40c8b71652ac1c3c3f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad4ebae5dbc2d47b544aa54f03c12490065be08a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98040","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:32.773","lastModified":"2026-10-19T10:17:57.910","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark the zero register precise for a register-form NULL check\n\ncheck_cond_jmp_op() accepts \"if rA <op> rB\" as a NULL check for a\nnullable pointer rA when rB is a scalar known to be zero,\nlifts PTR_MAYBE_NULL from rA in the corresponding branch and does not\nmark rB precise. Consider the following program:\n\n  r0 = bpf_get_prandom_u32();\n  r6 = 1;                  /* the r6 == 0 path is explored first */\n  if (r0 == 0) goto 1f;\n  r6 = 0;\n1:\n  r0 = bpf_map_lookup_elem(map, &0);  /* absent, NULL at runtime */\n  if (r0 == r6) goto 2f;   /* taken as a NULL check for r0       */\n  *(u8 *)(r0 + 0);         /* verifier: map value; runtime: zero */\n2:\n  return 0;\n\nThe r6 == 0 path is explored first and the dereference is accepted.\nThe r6 == 1 path is pruned at the checkpoint recorded for (1),\nso the comparison is never verified with a non-zero r6. At runtime a\nfailed lookup returns NULL, NULL != 1 takes the non-NULL edge and the\nprogram dereferences a pointer that is zero."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2f4cb53eed448c1aeb6f4b40cf9c810716d8218c","lessThan":"ddca9a3b8833168dda3e62676648a636fb3f221c","versionType":"git","status":"affected"},{"version":"2f4cb53eed448c1aeb6f4b40cf9c810716d8218c","lessThan":"6aed0134d3cda6382385a734ae0158eb7df6b142","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6aed0134d3cda6382385a734ae0158eb7df6b142","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ddca9a3b8833168dda3e62676648a636fb3f221c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98041","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:32.880","lastModified":"2026-10-21T13:21:19.813","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don't predict JMP32 pointer vs zero comparisons\n\nConsider the following program:\n\n        r1 = map_value;      /* low 32 bits are zero at runtime */\n        r6 = 0xdead000000000000;\n        if w1 != 0 goto l1;\n    l0: r1 += r6;\n        r2 = *(u64 *)(r1 + 0);\n        exit;\n    l1: r6 = 0;\n        goto l0;\n\nAt the moment is_branch_taken() reports the jump as always taken,\nbecause it does not distinguish between BPF_JMP and BPF_JMP32\ncomparisons when processing 'if w1 != 0 ...'."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cac616db39c207dc63465a4e05c6ce0e60b2cce4","lessThan":"6e1544986536734166176c3add504add23bcbd15","versionType":"git","status":"affected"},{"version":"cac616db39c207dc63465a4e05c6ce0e60b2cce4","lessThan":"d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d","versionType":"git","status":"affected"},{"version":"cac616db39c207dc63465a4e05c6ce0e60b2cce4","lessThan":"e2ae33247e8b2dbe9d116d3e61cadf6d548339c6","versionType":"git","status":"affected"},{"version":"cac616db39c207dc63465a4e05c6ce0e60b2cce4","lessThan":"a4d7f94c1ca914469ced665ec2f98be669aef462","versionType":"git","status":"affected"},{"version":"cac616db39c207dc63465a4e05c6ce0e60b2cce4","lessThan":"e51179a4e09846f8fd0f26a05068520de2b301bf","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/6e1544986536734166176c3add504add23bcbd15","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4d7f94c1ca914469ced665ec2f98be669aef462","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2ae33247e8b2dbe9d116d3e61cadf6d548339c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e51179a4e09846f8fd0f26a05068520de2b301bf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98042","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:32.987","lastModified":"2026-10-19T10:17:58.103","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don't resurrect a scalar id dropped by collect_linked_regs()\n\ncheck_cond_jmp_op() copies the compared registers into\nenv->{false,true}_reg{1,2} before collect_linked_regs() runs and copies\nthose snapshots back into both branch states afterwards.\n\ncollect_linked_regs() records at most LINKED_REGS_MAX members of a\nlinked registers group in the jump history and calls clear_scalar_id()\nfor every member that does not fit. The compared register is not exempt\nfrom that.\n\nAs a consequence, sync_linked_regs() might adjust ranges for more\nregisters than bpf_bt_sync_linked_regs() can propagate precision to.\n\nCollect the linked registers before the snapshots are taken instead.\nThis might lead to some unnecessary clear_scalar_id's, but from\nprevious testing situations with many linked registers are\nextremely rare."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ec1d77cb0ee98249142dcd0376d76e7a48ba0b31","lessThan":"e821ff19b8ef08255ff8d8234774ed814637e9bf","versionType":"git","status":"affected"},{"version":"ec1d77cb0ee98249142dcd0376d76e7a48ba0b31","lessThan":"73a98f96811e2cb0f4210b1caa8cb322f92f2a2b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/73a98f96811e2cb0f4210b1caa8cb322f92f2a2b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e821ff19b8ef08255ff8d8234774ed814637e9bf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98043","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:33.090","lastModified":"2026-10-21T13:21:19.943","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don't infer non-NULL from a pointer with an unbounded offset\n\nreg_not_null() decides that a register holds a non-NULL value by\nlooking at its type alone. For pointer types that allow arithmetic the\ntype only guarantees a non-NULL base, in case of an unbound offset\nthe runtime offset value might still add up to NULL.\nConsider the followng program:\n\n  r6 = bpf_map_lookup_elem(map, &0);  /* present */\n  if (r6 == 0) return 0;\n  r7 = bpf_map_lookup_elem(map, &1);  /* absent, NULL at runtime */\n  r8 = r7;\n  r8 -= r6;     /* pointer - pointer: unknown scalar, -r6 */\n  r8 <<= 1;\n  r8 >>= 1;     /* any non-negative offset is accepted by */\n                /* check_reg_sane_offset_ptr() */\n  r6 += r8;     /* verifier: map value;    runtime: zero  */\n  if (r7 != r6) return 0;\n  *(u8 *)(r7 + 0);  /* r7 is inferred non-NULL, both are zero */\n\nAt runtime both registers are zero, the comparison is true and the\nload faults with NULL pointer dereference.\n\nRequire the offset to be within +-BPF_MAX_VAR_OFF in reg_not_null()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cac616db39c207dc63465a4e05c6ce0e60b2cce4","lessThan":"8b414dbe97fcefd116e5a620c3bd9993014aa4ce","versionType":"git","status":"affected"},{"version":"cac616db39c207dc63465a4e05c6ce0e60b2cce4","lessThan":"019d845a08b8ccfe8eefaaf4bca6870f2b8c58ae","versionType":"git","status":"affected"},{"version":"cac616db39c207dc63465a4e05c6ce0e60b2cce4","lessThan":"65bea674f43c09c0eda033a140dfac6a2842a19f","versionType":"git","status":"affected"},{"version":"cac616db39c207dc63465a4e05c6ce0e60b2cce4","lessThan":"cb6642048739bf4ee5aa09fe465511f1e87caa63","versionType":"git","status":"affected"},{"version":"cac616db39c207dc63465a4e05c6ce0e60b2cce4","lessThan":"67b529f521a6676cdfc78b91b0217d7eaa84216b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/019d845a08b8ccfe8eefaaf4bca6870f2b8c58ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65bea674f43c09c0eda033a140dfac6a2842a19f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/67b529f521a6676cdfc78b91b0217d7eaa84216b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b414dbe97fcefd116e5a620c3bd9993014aa4ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cb6642048739bf4ee5aa09fe465511f1e87caa63","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98044","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:33.200","lastModified":"2026-10-21T13:21:20.053","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject legacy packet loads from callbacks\n\ncheck_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a\nsubprogram as an implicit return with R0 set to zero. It calls\nprepare_func_exit() to explore this synthesized path.\n\nWhen the load is reached directly from a synchronous callback,\nprepare_func_exit() enforces the callback return contract and marks R0\nprecise. R0 is not derived from a real instruction on this path, so\nprecision backtracking reaches the callback call with R0 still requested\nand triggers the \"callback unexpected regs\" verifier bug. A privileged\nprogram loader can therefore cause a verifier warning and an -EFAULT\nBPF_PROG_LOAD.\n\nThese legacy packet-load instructions are deprecated. Reject them from\ncallbacks rather than complicating their implicit-return model. Check all\nactive frames before constructing the implicit return so nested static\nsubprograms cannot hide the callback context.\n\nGlobal functions are verified independently with a fresh frame zero, so\nan active-frame check cannot identify a global function called from a\ncallback. Also check the complete subprogram call graph during stack-depth\nvalidation and reject a function containing a legacy load when any caller\nis a callback. This covers global and static descendants without making\nhas_ld_abs transitive, preserving its per-function BTF return-type check.\nOrdinary uses outside callbacks remain supported."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8674e2db06cff6b50f2216eed9a761d15425bb34","lessThan":"cebda2a2bb4183550eae9dcf888c16407b4fffda","versionType":"git","status":"affected"},{"version":"ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337","lessThan":"3484a99303912db62428494a9061212049027e57","versionType":"git","status":"affected"},{"version":"ee861486e377edc55361c08dcbceab3f6b6577bd","lessThan":"bc489c0c9b8c86bd7fac42cfd1bb152f042fca56","versionType":"git","status":"affected"},{"version":"ee861486e377edc55361c08dcbceab3f6b6577bd","lessThan":"e7d28823c662128caae63f14e16bd394916c139b","versionType":"git","status":"affected"},{"version":"928d354ae3557e8f755a227e67be88034eb3cd7f","versionType":"git","status":"affected"},{"version":"8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe","versionType":"git","status":"affected"},{"version":"de1055e7f9e67af32b1f3376066272b04e5223c0","versionType":"git","status":"affected"},{"version":"37ad2bb11e9de92cb7b94548705eeedd87f7d392","versionType":"git","status":"affected"},{"version":"d846d83bdacbd8f14fc45c63b8c1d22608452e1c","versionType":"git","status":"affected"},{"version":"6.12.101","lessThan":"6.12.114","versionType":"semver","status":"affected"},{"version":"6.18.42","lessThan":"6.18.53","versionType":"semver","status":"affected"},{"version":"5.10.265","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.15.216","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.183","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.6.148","lessThan":"6.7","versionType":"semver","status":"affected"},{"version":"7.0.10","lessThan":"7.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3484a99303912db62428494a9061212049027e57","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc489c0c9b8c86bd7fac42cfd1bb152f042fca56","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cebda2a2bb4183550eae9dcf888c16407b4fffda","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7d28823c662128caae63f14e16bd394916c139b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98045","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:33.330","lastModified":"2026-10-19T10:17:58.390","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark faultable stack helpers as sleepable\n\nThe faultable variants of bpf_get_stack() and bpf_get_task_stack() pass\nmay_fault=true into the common stack collection code. Resolving user-space\nbuild IDs may then call build_id_parse_file() and block on filesystem\nreads.\n\nNeither helper prototype sets might_sleep. Since prototype selection uses\nthe sleepability of the whole program, the verifier can still allow these\nhelpers from a non-sleepable region within that program, such as an\nexplicit RCU or preemption-disabled region. The task-stack helper can also\nbe called from a non-sleepable timer callback of a sleepable program.\n\nMark both faultable prototypes as sleepable. The existing helper context\ncheck then rejects these calls while continuing to allow them in genuinely\nsleepable contexts."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/stackmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d4dd9775ec242425576af93daadb80a34083a53c","lessThan":"44b8d370f2725bad215da3e67668e98ba96671bd","versionType":"git","status":"affected"},{"version":"d4dd9775ec242425576af93daadb80a34083a53c","lessThan":"3014e8a8bdad55075d89836ad9c10710a9a69837","versionType":"git","status":"affected"},{"version":"d4dd9775ec242425576af93daadb80a34083a53c","lessThan":"19e8d5a98afd071d8c1c5adeccf92b3c42eddc70","versionType":"git","status":"affected"},{"version":"d4dd9775ec242425576af93daadb80a34083a53c","lessThan":"9d02927fdf4e930893c92e35fed01a2704496900","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/stackmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/19e8d5a98afd071d8c1c5adeccf92b3c42eddc70","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3014e8a8bdad55075d89836ad9c10710a9a69837","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/44b8d370f2725bad215da3e67668e98ba96671bd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d02927fdf4e930893c92e35fed01a2704496900","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98046","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:33.440","lastModified":"2026-10-19T10:17:58.483","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark bpf_btf_find_by_name_kind() as sleepable\n\nWhen bpf_btf_find_by_name_kind() finds a type in module BTF, it\nreturns a new BTF object fd through __btf_new_fd(). This reaches\nanon_inode_getfd(), which can sleep while allocating or expanding the\ncurrent task fd table.\n\nThe helper prototype does not set might_sleep, so the verifier allows\nthe helper in non-sleepable contexts such as BPF timer callbacks. The\nfd allocation can then sleep in softirq context and install the fd into\nthe interrupted task.\n\nMark the helper as sleepable. This preserves calls from the main body\nof a sleepable syscall program while rejecting calls from its\nnon-sleepable regions."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/btf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3d78417b60fba249cc555468cb72d96f5cde2964","lessThan":"7bf23cf7c9c0e0b5e638e497cdc0ec3f223742cc","versionType":"git","status":"affected"},{"version":"3d78417b60fba249cc555468cb72d96f5cde2964","lessThan":"b843ab43ac9d2fa1ddd0dab8d0dcc19dbf764e2f","versionType":"git","status":"affected"},{"version":"3d78417b60fba249cc555468cb72d96f5cde2964","lessThan":"29e40175617216fbd4544529f6bfb51d1ab95ba1","versionType":"git","status":"affected"},{"version":"3d78417b60fba249cc555468cb72d96f5cde2964","lessThan":"4d8784226bd3c6a707975081f986078f40456cec","versionType":"git","status":"affected"},{"version":"3d78417b60fba249cc555468cb72d96f5cde2964","lessThan":"17f54a8f2b9714529d56edbbe12d448ccdbbf469","versionType":"git","status":"affected"},{"version":"3d78417b60fba249cc555468cb72d96f5cde2964","lessThan":"620614bf7672130c43b3cff375525a2202f61979","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/btf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/17f54a8f2b9714529d56edbbe12d448ccdbbf469","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29e40175617216fbd4544529f6bfb51d1ab95ba1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4d8784226bd3c6a707975081f986078f40456cec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/620614bf7672130c43b3cff375525a2202f61979","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7bf23cf7c9c0e0b5e638e497cdc0ec3f223742cc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b843ab43ac9d2fa1ddd0dab8d0dcc19dbf764e2f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98047","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:33.553","lastModified":"2026-10-21T13:21:20.180","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check ancestor frames for rbtree callbacks\n\nbpf_rbtree_add() invokes its comparator while the caller holds the root\nlock. The native insertion code retains raw parent and link pointers across\nthe callback, so the verifier prohibits unlocking, consuming tree nodes,\nor changing RCU state from that callback.\n\nin_rbtree_lock_required_cb() only checks the innermost verifier frame.\nStatic subprogram calls are permitted while holding a spin lock, and such a\ncall pushes a frame without in_callback_fn set. Consequently, all callback\nrestrictions disappear in the nested frame. The subprogram can unlock the\ntree, remove and drop the node being compared, then relock. Native insertion\nresumes with the stale parent pointer and links freed memory into the tree.\n\nWalk all active frames for the rbtree callback instead. Benign static\nsubprograms remain permitted, while callback restrictions follow execution\ninto nested frames."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a44b1334aadd82203f661adb9adb41e53ad0e8d1","lessThan":"252e9b476af723edd299a5c71c389ec018e46656","versionType":"git","status":"affected"},{"version":"a44b1334aadd82203f661adb9adb41e53ad0e8d1","lessThan":"b545fa447e09e6844868deb2bee228827fe54d15","versionType":"git","status":"affected"},{"version":"a44b1334aadd82203f661adb9adb41e53ad0e8d1","lessThan":"2410cb2ac0416dd2795a81984c8c73d7250bd8c4","versionType":"git","status":"affected"},{"version":"a44b1334aadd82203f661adb9adb41e53ad0e8d1","lessThan":"369f4ce734570bdfedaa4b5ca50e2a3f6a892728","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2410cb2ac0416dd2795a81984c8c73d7250bd8c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/252e9b476af723edd299a5c71c389ec018e46656","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/369f4ce734570bdfedaa4b5ca50e2a3f6a892728","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b545fa447e09e6844868deb2bee228827fe54d15","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98048","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:33.663","lastModified":"2026-10-21T13:21:20.280","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: don't rewrite bpf_fastcall patterns entered by a jump\n\nmark_fastcall_pattern_for_call() must ensure that matched\n\"spill; call; fill\" instruction series is not interrupted by a jump.\nOtherwise the rewrite applied by bpf_remove_fastcall_spills_fills()\nis not sound.\n\nRecord the instructions targeted by jumps in\ninsn_aux_data[*].jump_target when the CFG is built and use this flag\nto stop growing a pattern at such an instruction. Jumps to the first\nspill are fine.\n\nNote that existing insn_aux_data[*].jmp_point field can't be reused,\nas it marks subprogram return instructions."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/bpf_verifier.h","kernel/bpf/cfg.c","kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5b5f51bff1b66cedb62b5ba74a1878341204e057","lessThan":"a0cd1c3ac63504ba3c50c01a00c11812919b619f","versionType":"git","status":"affected"},{"version":"5b5f51bff1b66cedb62b5ba74a1878341204e057","lessThan":"c4d3bdb3ab211dcfad734b02e06fcb12adb4757f","versionType":"git","status":"affected"},{"version":"5b5f51bff1b66cedb62b5ba74a1878341204e057","lessThan":"24adbc2c3bbe3385ce922587e1f8e837a68b3e25","versionType":"git","status":"affected"},{"version":"5b5f51bff1b66cedb62b5ba74a1878341204e057","lessThan":"0b1c83dc3c4401cd7e846548f62e3caf3d06742e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/bpf_verifier.h","kernel/bpf/cfg.c","kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0b1c83dc3c4401cd7e846548f62e3caf3d06742e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/24adbc2c3bbe3385ce922587e1f8e837a68b3e25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0cd1c3ac63504ba3c50c01a00c11812919b619f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4d3bdb3ab211dcfad734b02e06fcb12adb4757f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98049","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:33.770","lastModified":"2026-10-21T13:21:20.380","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: zero extend the result of an arena 32-bit cmpxchg\n\nbpf_convert_ctx_accesses() rewrites an atomic on an arena pointer from\nBPF_STX | BPF_ATOMIC to BPF_STX | BPF_PROBE_ATOMIC, and it runs before\nbpf_opt_subreg_zext_lo32_rnd_hi32().\n\nThat pass emits an explicit zero extension for a 32-bit cmpxchg even\nwhen bpf_jit_needs_zext() is false. This is done because on some\narchitectures 32-bit cmpxchg requires explicit zero extension for the\ndst register. E.g. on x86-64 'lock cmpxchg' does not change the %eax\nif comparison is successful, while BPF semantics declare that each\noperation on a 32-bit register zero extends it's upper half.\n\nis_cmpxchg_insn() matches BPF_MODE == BPF_ATOMIC only, so an arena\ncmpxchg misses said zero extension adjustment. This patch adjusts\nis_cmpxchg_insn() to match BPF_PROBE_ATOMIC alongside BPF_ATOMIC."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/fixups.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d503a04f8bc0c75dc9db9452d8cc79d748afb752","lessThan":"1bb1be18263995b159cf5afad3a05500ba6d2a7b","versionType":"git","status":"affected"},{"version":"d503a04f8bc0c75dc9db9452d8cc79d748afb752","lessThan":"6bb6ae5ab1beffda51dabf41612f501d07f10fc6","versionType":"git","status":"affected"},{"version":"d503a04f8bc0c75dc9db9452d8cc79d748afb752","lessThan":"1c1b476d43a8b6c9bc04600369dd8cc39950d98e","versionType":"git","status":"affected"},{"version":"d503a04f8bc0c75dc9db9452d8cc79d748afb752","lessThan":"4814ed6406f3493bd554ad046da5f7fc04833571","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/fixups.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-681"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"7.2.7","matchCriteriaId":"F70EFEAC-5AFB-4B79-9877-7F142038EF90"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1bb1be18263995b159cf5afad3a05500ba6d2a7b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1c1b476d43a8b6c9bc04600369dd8cc39950d98e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/4814ed6406f3493bd554ad046da5f7fc04833571","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/6bb6ae5ab1beffda51dabf41612f501d07f10fc6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98050","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:33.873","lastModified":"2026-10-19T10:17:58.890","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context\n\nCurrently mlxsw_sp1_ptp_ht_gc_collect() is run from the PTP\ngarbage-collection workqueue, rather than the NAPI poll context. For any\nunmatched PTP entries carrying an SKB, it calls\nmlxsw_sp1_ptp_unmatched_finish() -> mlxsw_sp1_ptp_packet_finish(). For\ningress packets, this calls mlxsw_sp_rx_listener_no_mark_func(). The end\nof that function is the following:\n\n    skb->protocol = eth_type_trans(skb, skb->dev);\n    napi_gro_receive(mlxsw_skb_cb(skb)->rx_md_info.napi, skb);\n\nThe napi pointer is one that was placed in the SKB control block when the\ntrapped packet was received in the NAPI context. Later, when the GC reaps\nthe unmatched entry (up to MLXSW_SP1_PTP_HT_GC_TIMEOUT later), the call to\nnapi_gro_receive() mutates the NAPI instance's GRO list, which is unsafe\nif the poll is running concurrently on another CPU.\n\nIn mlxsw_sp1_ptp_ht_gc_collect(), local_bh_disable() is called to prevent\nsoftirq processing, but this only applies to the local CPU. Additionally,\nits comment is stale. It states that mlxsw_sp1_ptp_unmatched_finish()\ninvokes netif_receive_skb(). This has not been accurate since the\nreferenced commit; this patch makes that comment accurate again.\nmlxsw_pci_napi_devs_init() calls netif_threaded_enable() on the NAPI RX\nnet_device without any conditions. The NAPI instance's poll, which may be\nrunning concurrent to the GC, is running as an independently-scheduled\nkthread which may be on a different CPU. The call to local_bh_disable()\ndoes not guard against this.\n\nIf a tx-timestamp timeout produces an unmatched entry (which can be easily\nreproduced by running ptp4l and waiting for a port to reach the\nUNCALIBRATED/SLAVE state) while the owning NAPI thread is in the middle of\na poll on another CPU, both sides mutate the GRO list concurrently, as\nshown below:\n\n  [39.846] port 1 (swp1): MASTER to UNCALIBRATED on RS_SLAVE\n  list_add corruption. next->prev should be prev (ffff8d620faf4138), but was ffff8d624150f700. (next=ffff8d620faf4138).\n  kernel BUG at lib/list_debug.c:29!\n  Oops: invalid opcode: 0000 [#1] SMP PTI\n  CPU: 1 UID: 0 PID: 539 Comm: napi/mlxsw_rx-0 Not tainted 6.18.48 #1-NixOS PREEMPT(lazy)\n  Hardware name: Mellanox Technologies Ltd. MSN2410/VMOD0001, BIOS 4.6.5 09/13/2018\n  RIP: 0010:__list_add_valid_or_report+0x79/0xb0\n  RSP: 0018:ffffcdf8c0f27c08 EFLAGS: 00010246\n  RAX: 0000000000000075 RBX: ffff8d624150fd00 RCX: 0000000000000000\n  RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8d6315d1e540\n  RBP: ffff8d620faf4070 R08: 0000000000000000 R09: 00000000ffffdfff\n  R10: ffffffffa5c60fe0 R11: ffffcdf8c0f27ab8 R12: 0000000000000003\n  R13: 000000000000003d R14: 00000000000001bc R15: 0000000000000001\n  FS:  0000000000000000(0000) GS:ffff8d636f63f000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000562689a60c24 CR3: 000000015f224004 CR4: 00000000001726f0\n  Call Trace:\n  <TASK>\n  gro_receive_skb+0xee/0x230\n  mlxsw_sp1_ptp_got_packet+0x61/0x140 [mlxsw_spectrum]\n  mlxsw_core_skb_receive+0xdf/0x1b0 [mlxsw_core]\n  mlxsw_pci_napi_poll_cq_rx+0x780/0x9d0 [mlxsw_pci]\n  __napi_poll+0x31/0x1e0\n  napi_threaded_poll_loop+0x16b/0x1c0\n  napi_threaded_poll+0x71/0xa0\n  kthread+0xfb/0x260\n  ret_from_fork+0x22d/0x260\n  ret_from_fork_asm+0x1a/0x30\n  </TASK>\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nThe machinery that leads to this kernel panic has not been changed between\n6.18.48 and mainline.\n\nThis patch adds an ingress-delivery helper for the PTP packet_finish()\npath that calls netif_receive_skb() instead of napi_gro_receive().\nnetif_receive_skb(), unlike napi_gro_receive(), can be called from outside\nof the NAPI instance's poll context, which can occur at the call site for\nthis path. RX stats accounting and the skb->dev assignment are still\npreserved; the only change is the delivery call itself.\n\nThis removes GR\n---truncated---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1ba06ca96ca255c079ce5ea6a75cc0bfd5e97921","lessThan":"4375b3d1c2898886df1f908160c7004bdd938e73","versionType":"git","status":"affected"},{"version":"1ba06ca96ca255c079ce5ea6a75cc0bfd5e97921","lessThan":"7ddcc460176eb34f9bc5bda3cc274d0d24dc62a9","versionType":"git","status":"affected"},{"version":"1ba06ca96ca255c079ce5ea6a75cc0bfd5e97921","lessThan":"2ac174dfcdde399fa95ba889541fb5e688d8bb35","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"6.18.53","matchCriteriaId":"3715AAFB-3916-4AF2-BE3B-9D0A16B1B82D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*","matchCriteriaId":"14FD7B9A-4946-4511-8E63-6E13870CD4A8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/2ac174dfcdde399fa95ba889541fb5e688d8bb35","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/4375b3d1c2898886df1f908160c7004bdd938e73","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/7ddcc460176eb34f9bc5bda3cc274d0d24dc62a9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98051","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:34.010","lastModified":"2026-10-19T10:17:59.047","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmasp: fix tx_spb_ring_full() checking same slot cnt times\n\nThe loop initialised next_index from intf->tx_spb_index on every\niteration, so incr_ring() always produced the same result and only\none slot was ever tested.  Move the initialisation before the loop\nso each iteration advances next_index and the function correctly\nchecks that cnt consecutive descriptor slots are available before\nallowing a new transmission."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"490cb412007de593e07c1d3e2b1ec4233886707c","lessThan":"990df1ba4d0805d1e7f6148c364febd2ab618766","versionType":"git","status":"affected"},{"version":"490cb412007de593e07c1d3e2b1ec4233886707c","lessThan":"f7f7a16dd46ace4e221336a184c7806f7de19547","versionType":"git","status":"affected"},{"version":"490cb412007de593e07c1d3e2b1ec4233886707c","lessThan":"a8bddab54aa68b407f12294acb05bd552fb6a492","versionType":"git","status":"affected"},{"version":"490cb412007de593e07c1d3e2b1ec4233886707c","lessThan":"5df7ecd302488287665ab9767bacba7ed7e2842f","versionType":"git","status":"affected"},{"version":"490cb412007de593e07c1d3e2b1ec4233886707c","lessThan":"0c5cf62e72d7a666ee4da757e122dc1600df1ecc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-670"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.158","matchCriteriaId":"4F4B14AC-C632-4A61-9E23-076CC1A04CEA"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*","matchCriteriaId":"14FD7B9A-4946-4511-8E63-6E13870CD4A8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0c5cf62e72d7a666ee4da757e122dc1600df1ecc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/5df7ecd302488287665ab9767bacba7ed7e2842f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/990df1ba4d0805d1e7f6148c364febd2ab618766","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/a8bddab54aa68b407f12294acb05bd552fb6a492","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f7f7a16dd46ace4e221336a184c7806f7de19547","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98052","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:34.120","lastModified":"2026-10-19T10:17:59.170","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmasp: clear txcb->last before writing each descriptor\n\nbcmasp_xmit() only wrote txcb->last = true for the final fragment\nof an SKB; non-final fragments left the field untouched.  If a\ndescriptor slot was reused while it still held a stale true from\na previous SKB (possible when tx_spb_ring_full() underreported\nfullness), bcmasp_tx_reclaim() would see last == true mid-SKB and\ncall dev_consume_skb_any() prematurely, freeing the sk_buff while\nits remaining fragments were still in flight.\n\nUnconditionally clear txcb->last before the conditional set so every\ndescriptor slot starts from a known false state regardless of what a\nprior transmission left behind."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"490cb412007de593e07c1d3e2b1ec4233886707c","lessThan":"1e213ba7cb3b9dd97ac2e0a1054e6d0d1d91f5bc","versionType":"git","status":"affected"},{"version":"490cb412007de593e07c1d3e2b1ec4233886707c","lessThan":"9b26b54861ce05307d39a54ddedddf8747419614","versionType":"git","status":"affected"},{"version":"490cb412007de593e07c1d3e2b1ec4233886707c","lessThan":"47a5cecca925ceb175d5adf712e667acf78f475f","versionType":"git","status":"affected"},{"version":"490cb412007de593e07c1d3e2b1ec4233886707c","lessThan":"17e6ad484dea5ddf1c4a3d6ec77a5929161234de","versionType":"git","status":"affected"},{"version":"490cb412007de593e07c1d3e2b1ec4233886707c","lessThan":"18e5e0ec0e9282c897e2aa81a3e43ccaee03b003","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.158","matchCriteriaId":"4F4B14AC-C632-4A61-9E23-076CC1A04CEA"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*","matchCriteriaId":"14FD7B9A-4946-4511-8E63-6E13870CD4A8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/17e6ad484dea5ddf1c4a3d6ec77a5929161234de","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/18e5e0ec0e9282c897e2aa81a3e43ccaee03b003","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/1e213ba7cb3b9dd97ac2e0a1054e6d0d1d91f5bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/47a5cecca925ceb175d5adf712e667acf78f475f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/9b26b54861ce05307d39a54ddedddf8747419614","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98053","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:34.227","lastModified":"2026-10-21T13:21:20.497","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Refactor and fix init_config access\n\nExisting code accesses enties found in ->init_configs array through\nindexes that are part of ->config_ids array.  Those two are limited by:\n->num_init_configs and ->num_config_ids respectively.  Using ID larger\nor equal to ->num_init_configs leads to out-of-bounds access:\n\navs_path_module_send_init_configs()\nloop:\n\t(...) &acomp->tplg->init_configs[ids[i]]\n\t\t\t\t\t^ out-of-bounds candidate\n\nRather than adding another if-statement, refactor the code.  There is no\nneed to store the IDs, have a list of pointers to actual config-entries\ninstead.  As the verification of ->init_config entries does not differ from\nverification of other types that are part of the topology.c file, simply\nreuse the code."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/soc/intel/avs/path.c","sound/soc/intel/avs/topology.c","sound/soc/intel/avs/topology.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8a49ef789b1be68242624d460df2ada8087308a7","lessThan":"70ffcaf86a053be99daaf3b103beac0ad7136ca3","versionType":"git","status":"affected"},{"version":"8a49ef789b1be68242624d460df2ada8087308a7","lessThan":"75bd5ea9c858d89fb8862f23afb00783bf02cd7a","versionType":"git","status":"affected"},{"version":"8a49ef789b1be68242624d460df2ada8087308a7","lessThan":"8f20a0f4f7d638e83ae86db1719a24c7049762f5","versionType":"git","status":"affected"},{"version":"8a49ef789b1be68242624d460df2ada8087308a7","lessThan":"681e91035dc794896a904852040837190e5041f5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/soc/intel/avs/path.c","sound/soc/intel/avs/topology.c","sound/soc/intel/avs/topology.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.18.53","matchCriteriaId":"6F4F0F44-2856-4E10-A046-0A6A4C7B3412"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*","matchCriteriaId":"14FD7B9A-4946-4511-8E63-6E13870CD4A8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/681e91035dc794896a904852040837190e5041f5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/70ffcaf86a053be99daaf3b103beac0ad7136ca3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/75bd5ea9c858d89fb8862f23afb00783bf02cd7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/8f20a0f4f7d638e83ae86db1719a24c7049762f5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98054","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:34.330","lastModified":"2026-10-19T10:17:59.423","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Fix unbalanced module reference count\n\nstrace_open() invokes try_module_get() which on success takes\nthe module reference.  If any follow up operation causes\nstrace_open() to fail, the refcount shall be put down."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/soc/intel/avs/debugfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0a5fb3cc28fda52c761775db2ccb7ccb954aee2a","lessThan":"3fcf670f023d47e4eb970fb886ee562b5bdfbee7","versionType":"git","status":"affected"},{"version":"0a5fb3cc28fda52c761775db2ccb7ccb954aee2a","lessThan":"23ebd4ed5799340f1d2193195c97f61d39aa9899","versionType":"git","status":"affected"},{"version":"0a5fb3cc28fda52c761775db2ccb7ccb954aee2a","lessThan":"60b396b2aeca303bc468937d2b44a82399f37b3c","versionType":"git","status":"affected"},{"version":"0a5fb3cc28fda52c761775db2ccb7ccb954aee2a","lessThan":"d4fa6f94b91137e329ea3f5b360e140b227bb696","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/soc/intel/avs/debugfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*","matchCriteriaId":"14FD7B9A-4946-4511-8E63-6E13870CD4A8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/23ebd4ed5799340f1d2193195c97f61d39aa9899","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/3fcf670f023d47e4eb970fb886ee562b5bdfbee7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/60b396b2aeca303bc468937d2b44a82399f37b3c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d4fa6f94b91137e329ea3f5b360e140b227bb696","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98055","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:34.440","lastModified":"2026-10-19T10:17:59.533","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Clean up the bus when fetching ML caps fails\n\nsnd_hdac_ext_bus_get_ml_capabilities() may fail and its return code\nshall be checked and accounted for. Address the issue by updating the\nerror-path for avs_pci_probe().\n\nAt the same time, if the function in question succeeds but the next part\nof avs_pci_probe() fails, the hlink list shall be cleaned up before\nleaving the scope."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/soc/intel/avs/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1affc44ea5dd554c103e0ce1e809f3aa5d942349","lessThan":"68885c606a6e41dd4d3fe72f11241a6a438246ed","versionType":"git","status":"affected"},{"version":"1affc44ea5dd554c103e0ce1e809f3aa5d942349","lessThan":"a16ca1987ce8666c13482437db21232d41600e3f","versionType":"git","status":"affected"},{"version":"1affc44ea5dd554c103e0ce1e809f3aa5d942349","lessThan":"2d96325e8ed97ec70623f788c35cca5d68c34351","versionType":"git","status":"affected"},{"version":"1affc44ea5dd554c103e0ce1e809f3aa5d942349","lessThan":"498bf26639e99a98e7a3db880a7da8251aaf4289","versionType":"git","status":"affected"},{"version":"1affc44ea5dd554c103e0ce1e809f3aa5d942349","lessThan":"04447cd14ebcc924f2d745dd33b9506735bda5b4","versionType":"git","status":"affected"},{"version":"1affc44ea5dd554c103e0ce1e809f3aa5d942349","lessThan":"559ea14b7ae7c7562b48759fa545b64958f35b73","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/soc/intel/avs/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/04447cd14ebcc924f2d745dd33b9506735bda5b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2d96325e8ed97ec70623f788c35cca5d68c34351","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/498bf26639e99a98e7a3db880a7da8251aaf4289","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/559ea14b7ae7c7562b48759fa545b64958f35b73","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68885c606a6e41dd4d3fe72f11241a6a438246ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a16ca1987ce8666c13482437db21232d41600e3f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98056","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:34.547","lastModified":"2026-10-21T13:21:20.620","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: remove stale namespaces by NSID range during scan\n\nnvme_scan_ns_list() drops the stale namespaces in each gap in the\nreported NSID list one NSID at a time. Every iteration calls\nnvme_find_get_ns() to look the namespace up and removes it if it is\npresent. The loop runs once per NSID in the gap rather than once per\nnamespace actually present.\n\nNSIDs are 32-bit, so a target with a sparse NSID space can make a\nsingle gap spin the loop billions of times with nothing to remove.\n\n  watchdog: BUG: soft lockup - CPU#4 stuck for 26s!\n  Workqueue: nvme-wq nvme_scan_work [nvme_core]\n  RIP: 0010:__srcu_read_unlock+0xb/0x20\n  Call Trace:\n   nvme_find_get_ns+0x7d/0xb0 [nvme_core]\n   nvme_scan_ns_list+0xe8/0x280 [nvme_core]\n   nvme_scan_work+0x18a/0x280 [nvme_core]\n   process_one_work+0x197/0x380\n   worker_thread+0x2fe/0x410\n   kthread+0xe0/0x100\n\nRename nvme_remove_invalid_namespaces() to nvme_remove_nsid_range()\nand give it an open (start, end) NSID range. ctrl->namespaces is\nsorted by NSID, so the whole gap is dropped in a single walk that\nstops once end is reached. This bounds the work by the namespaces\nthat are present instead of by the size of the gap."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/nvme/host/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"540c801c65eb58e05e0ca38b6fd644a83d7e2b33","lessThan":"e6a94b2c4c80a38002346ce915a9b9a3d478a3e6","versionType":"git","status":"affected"},{"version":"540c801c65eb58e05e0ca38b6fd644a83d7e2b33","lessThan":"c84ad7407fb16b92d9b7a649cc304a9cf3757897","versionType":"git","status":"affected"},{"version":"540c801c65eb58e05e0ca38b6fd644a83d7e2b33","lessThan":"f56b2bb4b18b017b056c4c17c66b2c4c54bf6ee4","versionType":"git","status":"affected"},{"version":"540c801c65eb58e05e0ca38b6fd644a83d7e2b33","lessThan":"52200fc41a79da430ccf7c126ed837535b087ea2","versionType":"git","status":"affected"},{"version":"540c801c65eb58e05e0ca38b6fd644a83d7e2b33","lessThan":"4ed7f3d7d435bf5b63da2814dc9270f5ba896011","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/nvme/host/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.5","status":"affected"},{"version":"0","lessThan":"4.5","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/4ed7f3d7d435bf5b63da2814dc9270f5ba896011","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/52200fc41a79da430ccf7c126ed837535b087ea2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c84ad7407fb16b92d9b7a649cc304a9cf3757897","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6a94b2c4c80a38002346ce915a9b9a3d478a3e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f56b2bb4b18b017b056c4c17c66b2c4c54bf6ee4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98057","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:34.660","lastModified":"2026-10-19T10:17:59.870","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Add checking nr_subbufs to persistent ring buffer validation\n\nSashiko reported that the code was using meta->nr_subbufs without making\nsure that it matched the nr_pages + 1 on data that was assuming the two\nwere the same.\n\nAdd a check to the persistent ring buffer validation code to make sure\nthat the saved nr_subbufs matches what we expect."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/ring_buffer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3ec743d558f111d8999aea24577ba66c65ee2eeb","lessThan":"f0467190e6a9fc61e343c8064ef16aad513788c3","versionType":"git","status":"affected"},{"version":"f5b95f1fa2ef3a03f49eeec658ba97e721412b32","lessThan":"364a31052aa9ef91db137f82d797366007cd85b7","versionType":"git","status":"affected"},{"version":"f5b95f1fa2ef3a03f49eeec658ba97e721412b32","lessThan":"69d502457e3f76142f7fcf6e2625e80e0ce8a60f","versionType":"git","status":"affected"},{"version":"f5b95f1fa2ef3a03f49eeec658ba97e721412b32","lessThan":"6c001a62c34f13fe1c6a24304c289b387d9e697d","versionType":"git","status":"affected"},{"version":"0d547a6f5e8fad26ebc12f501d7d19fccdbad6bf","versionType":"git","status":"affected"},{"version":"6.12.16","lessThan":"6.12.111","versionType":"semver","status":"affected"},{"version":"6.13.4","lessThan":"6.14","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/ring_buffer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/364a31052aa9ef91db137f82d797366007cd85b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/69d502457e3f76142f7fcf6e2625e80e0ce8a60f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6c001a62c34f13fe1c6a24304c289b387d9e697d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0467190e6a9fc61e343c8064ef16aad513788c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98058","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:34.767","lastModified":"2026-10-21T13:21:20.827","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark syscall helpers as sleepable\n\nbpf_sys_bpf() executes the bpf(2) syscall body, which can take mutexes,\nallocate with GFP_KERNEL, and wait for an RCU grace period.\nbpf_sys_close() reaches close_fd() and filp_close(), which can sleep as\nwell.\n\nBoth helpers are limited to BPF_PROG_TYPE_SYSCALL, whose main program is\nsleepable. That does not make every callback sleepable: a syscall program\ncan register a bpf_timer callback, and the verifier checks that callback\nin a non-sleepable context while retaining the syscall helper set.\n\nWithout .might_sleep on the prototypes, such a callback can invoke\nbpf_sys_bpf() from hrtimer softirq context and trigger a\nscheduling-while-atomic failure. bpf_sys_close() is exposed through the\nsame missing context check.\n\nSet .might_sleep on both prototypes so the existing helper-context check\nrejects them from timer callbacks and other atomic regions. Calls from the\nsleepable main body remain valid."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/syscall.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"79a7f8bdb159d9914b58740f3d31d602a6e4aca8","lessThan":"9496d857205e60241034b798d7745ff8830ba599","versionType":"git","status":"affected"},{"version":"79a7f8bdb159d9914b58740f3d31d602a6e4aca8","lessThan":"d8cfe9f71d302970ae393616960f2b3021d2b3b0","versionType":"git","status":"affected"},{"version":"79a7f8bdb159d9914b58740f3d31d602a6e4aca8","lessThan":"65f636322ac402add6046c68e9ece77b9ffd71c9","versionType":"git","status":"affected"},{"version":"79a7f8bdb159d9914b58740f3d31d602a6e4aca8","lessThan":"3408e98f06ce06ea6a58ca6c39da9c23f0029c06","versionType":"git","status":"affected"},{"version":"79a7f8bdb159d9914b58740f3d31d602a6e4aca8","lessThan":"d05524794240b52fdc3b6c1220dd05505715824d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/syscall.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3408e98f06ce06ea6a58ca6c39da9c23f0029c06","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65f636322ac402add6046c68e9ece77b9ffd71c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9496d857205e60241034b798d7745ff8830ba599","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d05524794240b52fdc3b6c1220dd05505715824d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d8cfe9f71d302970ae393616960f2b3021d2b3b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98059","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:34.873","lastModified":"2026-10-19T10:18:00.180","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark sched_process_wait argument as nullable\n\ndo_wait() passes wo->wo_pid to the sched_process_wait tracepoint.\nkernel_wait4() leaves wo_pid NULL for wait4(-1), and\nkernel_waitid_prepare() does likewise for waitid(P_ALL).\n\nbtf_ctx_access() currently types argument 0 as PTR_TO_BTF_ID |\nPTR_TRUSTED. Without PTR_MAYBE_NULL, the verifier accepts an unchecked\ndereference. Trusted pointer loads have no fault protection, so a wait for\nany child can then cause a NULL pointer dereference in JITed BPF code.\n\nAdd sched_process_wait to raw_tp_null_args[] with argument 0 marked\nnullable. The verifier rejects an unchecked dereference while preserving\naccess after the program checks the pointer for NULL."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/btf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b2fc4b17fc13810ef440fb323fad3981cd174985","lessThan":"bee862c79cb7e0e5c33b2df2e3a31d164705120d","versionType":"git","status":"affected"},{"version":"838a10bd2ebfe11a60dd67687533a7cfc220cc86","lessThan":"3c03a1b8ded858685a73c1ba4080adef99db4544","versionType":"git","status":"affected"},{"version":"838a10bd2ebfe11a60dd67687533a7cfc220cc86","lessThan":"b9205e936dde9a94e93376c8de6195b740bcd5d2","versionType":"git","status":"affected"},{"version":"838a10bd2ebfe11a60dd67687533a7cfc220cc86","lessThan":"a453d6e3b8e8e1a321c8744d6189d763af9287d0","versionType":"git","status":"affected"},{"version":"6.12.6","lessThan":"6.12.111","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/btf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3c03a1b8ded858685a73c1ba4080adef99db4544","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a453d6e3b8e8e1a321c8744d6189d763af9287d0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9205e936dde9a94e93376c8de6195b740bcd5d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bee862c79cb7e0e5c33b2df2e3a31d164705120d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98060","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:35.000","lastModified":"2026-10-19T10:18:00.350","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject resilient lock operations in rbtree callbacks\n\n__bpf_rbtree_add() keeps parent and link pointers live across calls to the\nprogram-supplied comparison callback. The verifier therefore requires the\nroot's lock to remain held throughout the callback.\n\nThe helper path enforces this rule for bpf_spin_lock() and\nbpf_spin_unlock(), but the resilient lock kfunc argument path does not.\nSince resilient locks may protect BPF rbtree roots, a callback can release\nthe root lock and let another CPU remove and free the node referenced by\nthe in-progress tree walk. The walk then resumes using freed pointers.\n\nReject resilient lock kfuncs in an rbtree comparison callback, matching\nthe existing policy for the spin lock helpers. Resilient-lock-protected\ntrees remain valid when their comparison callbacks leave lock state alone."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0de2046137f976e7302d43ac01d9894d07ac1fff","lessThan":"cc2e065ed206aecd9b94564779244f3ffb26e356","versionType":"git","status":"affected"},{"version":"0de2046137f976e7302d43ac01d9894d07ac1fff","lessThan":"71930202a0a0c49f0a3b45b41907a074cb780266","versionType":"git","status":"affected"},{"version":"0de2046137f976e7302d43ac01d9894d07ac1fff","lessThan":"7b7b8b5960102566bd625ae829d1f330c5b5d104","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/71930202a0a0c49f0a3b45b41907a074cb780266","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7b7b8b5960102566bd625ae829d1f330c5b5d104","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc2e065ed206aecd9b94564779244f3ffb26e356","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98061","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:35.110","lastModified":"2026-10-19T10:18:00.497","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject tail calls directly from callback frames\n\nA tail call from a non-zero frame is modeled as a return from that frame.\nThe verifier makes R0 unknown and calls prepare_func_exit() for the taken\nbranch.\n\nWhen the current frame is a synchronous callback, prepare_func_exit()\nenforces the callback return-value contract and marks R0 precise. Since the\ntail-call path synthesized R0 rather than deriving it from an instruction,\nprecision backtracking reaches the callback-calling instruction with R0\nstill requested and triggers the \"callback unexpected regs\" verifier bug.\nA CAP_BPF task can therefore cause a WARN and an -EFAULT BPF_PROG_LOAD.\n\nTail calls reachable from callbacks are already rejected later by\ncheck_max_stack_depth(). Reject a tail call made directly by a callback\nbefore constructing the inconsistent return state, using the existing\ndiagnostic. Tail calls from ordinary subprograms keep their current\nbehavior."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a6c22c91b6284e4713c0cf5b20ab3c9c71b77ae8","lessThan":"617c8266e49f45747f71e74177646a63f72b7025","versionType":"git","status":"affected"},{"version":"e3245f8990431950d20631c72236d4e8cb2dcde8","lessThan":"96d31b28263c429a56e4de85bcf744a5c320b3a3","versionType":"git","status":"affected"},{"version":"e3245f8990431950d20631c72236d4e8cb2dcde8","lessThan":"266aa4ad0b2e82397cd9045752c9bff03d98eddd","versionType":"git","status":"affected"},{"version":"6.18.2","lessThan":"6.18.53","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/266aa4ad0b2e82397cd9045752c9bff03d98eddd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/617c8266e49f45747f71e74177646a63f72b7025","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96d31b28263c429a56e4de85bcf744a5c320b3a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98062","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:35.220","lastModified":"2026-10-21T13:21:20.990","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark signal tracepoint siginfo arguments as scalar\n\nThe signal_generate and signal_deliver tracepoints declare their info\nargument as a struct kernel_siginfo pointer. btf_ctx_access() therefore\ntreats it as a trusted pointer for tp_btf programs.\n\nSignal delivery also uses SEND_SIG_NOINFO and SEND_SIG_PRIV as special\nvalues for this argument. Those values are zero and one respectively,\nand are not pointers. A tp_btf program can currently dereference either\nvalue and fault the kernel. In particular, signal_generate can run from\ntimer interrupt context, turning the fault into a kernel panic.\n\nRecord both tracepoints in raw_tp_null_args[] and mark argument one as\na non-pointer. This preserves scalar access to the cookie while rejecting\ndirect and helper-mediated pointer use. Merely marking it nullable would\nnot suffice because SEND_SIG_PRIV is nonzero."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/btf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b2fc4b17fc13810ef440fb323fad3981cd174985","lessThan":"05757377fa0447163d07c43a119f81abe1eef8dc","versionType":"git","status":"affected"},{"version":"838a10bd2ebfe11a60dd67687533a7cfc220cc86","lessThan":"0e78cb242a57e481061fcb542fed4d51afba25c4","versionType":"git","status":"affected"},{"version":"838a10bd2ebfe11a60dd67687533a7cfc220cc86","lessThan":"d2eaea3599bcce659ce91862254dc91bcbdb6351","versionType":"git","status":"affected"},{"version":"838a10bd2ebfe11a60dd67687533a7cfc220cc86","lessThan":"77515ab12e4983e6416f8c35039a3f0c0822ac70","versionType":"git","status":"affected"},{"version":"6.12.6","lessThan":"6.12.114","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/btf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-476"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.6","versionEndExcluding":"6.13","matchCriteriaId":"14EE4FDC-9A0F-4EFF-AFC6-AC3D89B541C1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13.1","versionEndExcluding":"6.18.53","matchCriteriaId":"5236373F-7C8D-4A67-8517-6076577CD65E"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*","matchCriteriaId":"5A3F9505-6B98-4269-8B81-127E55A1BF00"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*","matchCriteriaId":"DE491969-75AE-4A6B-9A58-8FC5AF98798F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*","matchCriteriaId":"93C0660D-7FB8-4FBA-892A-B064BA71E49E"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*","matchCriteriaId":"034C36A6-C481-41F3-AE9A-D116E5BE6895"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*","matchCriteriaId":"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*","matchCriteriaId":"5DFCDFB8-4FD0-465A-9076-D813D78FE51B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/05757377fa0447163d07c43a119f81abe1eef8dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0e78cb242a57e481061fcb542fed4d51afba25c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/77515ab12e4983e6416f8c35039a3f0c0822ac70","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d2eaea3599bcce659ce91862254dc91bcbdb6351","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98063","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:35.327","lastModified":"2026-10-19T10:18:00.800","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix NULL-ptr-deref in btf_var_show()\n\nbtf_var_show() calls btf_type_id_resolve() unconditionally, which\ndereferences btf->resolved_ids. That is NULL for a base BTF - e.g. the\nvmlinux BTF that bpf_snprintf_btf() renders against - since base BTF is\nnot resolved during parsing. btf_modifier_show() guards this with\n'if (btf->resolved_ids)', but btf_var_show() does not.\n\nA BPF program that passes the type_id of a BTF_KIND_VAR from the vmlinux\nBTF to bpf_snprintf_btf() thus NULL-derefs:\n\nKASAN: probably user-memory-access in range [0x46638-0x4663f]\nRIP: 0010:btf_var_show (kernel/bpf/btf.c:2929)\nCall Trace:\n <TASK>\n btf_type_show (kernel/bpf/btf.c:8259)\n btf_type_snprintf_show (kernel/bpf/btf.c:8329)\n bpf_snprintf_btf (kernel/trace/bpf_trace.c:1047)\n bpf_prog_test_run_raw_tp (net/bpf/test_run.c:829)\n __sys_bpf (kernel/bpf/syscall.c:4804)\n do_syscall_64 (arch/x86/entry/syscall_64.c:84)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n </TASK>\n\nResolve the var's type directly with btf_type_skip_modifiers() when\nresolved_ids is NULL, mirroring btf_modifier_show()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/btf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"5756450c9a702da0efb4a993d0a6766b965736f3","versionType":"git","status":"affected"},{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"e83fcbe3b5d4a1ffb0569bb7c280358065c6017a","versionType":"git","status":"affected"},{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"e0d6a06171633d3ee3f7a39b57e5c845fb2b79f2","versionType":"git","status":"affected"},{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"aec0a9c1579eb9edf534960be592d09481bd7ac3","versionType":"git","status":"affected"},{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"e472ae0d97865e2021ee668a13eab64013aebf23","versionType":"git","status":"affected"},{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"ca086264e98108b44fdf53971033811a48defe2b","versionType":"git","status":"affected"},{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"ea383b3ea56979ce54c8aa88e6ec67164986c401","versionType":"git","status":"affected"},{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"5403a383f52fc0905703b488f7c3db4b2447dc58","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/btf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5403a383f52fc0905703b488f7c3db4b2447dc58","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5756450c9a702da0efb4a993d0a6766b965736f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aec0a9c1579eb9edf534960be592d09481bd7ac3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ca086264e98108b44fdf53971033811a48defe2b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e0d6a06171633d3ee3f7a39b57e5c845fb2b79f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e472ae0d97865e2021ee668a13eab64013aebf23","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e83fcbe3b5d4a1ffb0569bb7c280358065c6017a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea383b3ea56979ce54c8aa88e6ec67164986c401","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98064","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:35.437","lastModified":"2026-10-19T10:18:00.973","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix NULL-ptr-deref when showing a void BTF type\n\nbtf_modifier_show() resolves the modifier and then calls\nbtf_type_ops(t)->show() unconditionally. For the void type (type_id 0,\nBTF_KIND_UNKN) kind_ops[] has no entry, so ->show is NULL.\n\nA \"const void\" (a modifier resolving to void) cannot be a map key or\nvalue - map_check_btf() rejects it because void has no size - so the map\ndump path does not reach it. But bpf_snprintf_btf() takes a type_id\nstraight from the BPF program, and passing such a \"const void\" from the\nvmlinux BTF NULL-derefs:\n\nKASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]\nRIP: 0010:btf_modifier_show (kernel/bpf/btf.c:2914)\nCall Trace:\n <TASK>\n btf_type_show (kernel/bpf/btf.c:8251)\n btf_type_snprintf_show (kernel/bpf/btf.c:8321)\n bpf_snprintf_btf (kernel/trace/bpf_trace.c:1047)\n bpf_prog_test_run_raw_tp (net/bpf/test_run.c:829)\n __sys_bpf (kernel/bpf/syscall.c:4804)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n </TASK>\n\nFall back to btf_df_show() when the resolved type has no show op; it\nemits the \"<unsupported kind:N>\" placeholder already used for kinds like\nFWD and FUNC. bpf_snprintf_btf() then returns the length as usual."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/btf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"cf528f2d7a0a54f2a3c6d439cfa3c8d7dfe90d8d","versionType":"git","status":"affected"},{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"adb15557a641cb8a31f83e5f62bd12042b138c7b","versionType":"git","status":"affected"},{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"62b00074b58ccf43f61f70f2cfcac80937b530c6","versionType":"git","status":"affected"},{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"86d86f9fcf62dd3654090fbf3cf7ae5f42aa0706","versionType":"git","status":"affected"},{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"717abdfd1d559d01fdd102023f0a990fb0437240","versionType":"git","status":"affected"},{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"98f1cb95221332139acf514350ae2cae3b8656c5","versionType":"git","status":"affected"},{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"5324f4e75ff6e9c2ca2e267c5f34f0937f9d0ac9","versionType":"git","status":"affected"},{"version":"c4d0bfb45068d853a478b9067a95969b1886a30f","lessThan":"4ea508b9ebd78bce7f212166d2e2cba66b875f08","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/btf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4ea508b9ebd78bce7f212166d2e2cba66b875f08","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5324f4e75ff6e9c2ca2e267c5f34f0937f9d0ac9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62b00074b58ccf43f61f70f2cfcac80937b530c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/717abdfd1d559d01fdd102023f0a990fb0437240","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/86d86f9fcf62dd3654090fbf3cf7ae5f42aa0706","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98f1cb95221332139acf514350ae2cae3b8656c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/adb15557a641cb8a31f83e5f62bd12042b138c7b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf528f2d7a0a54f2a3c6d439cfa3c8d7dfe90d8d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98065","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:35.553","lastModified":"2026-10-19T10:18:01.150","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject key-less BTF for hash maps\n\nmap_check_btf() allows a key-less BTF (btf_key_type_id == 0) only for\nmaps that have a ->map_check_btf callback, and leaves the actual\ndecision to that callback. Hash maps used to have no ->map_check_btf,\nso a key-less BTF was rejected outright.\n\nThat changed when htab and rhtab gained a ->map_check_btf to register a\ndtor - htab in commit 1df97a7453ee (\"bpf: Register dtor for freeing\nspecial fields\") and rhtab in commit 6905f8601298 (\"bpf: Allow special\nfields in resizable hashtab\"). Neither looks at the key, so a key-less\nhash map now passes map_check_btf() and gets created. Reading it back\nthrough bpffs feeds the key type_id 0 into btf_type_seq_show();\nbtf_type_by_id() returns the void type, kind_ops[BTF_KIND_UNKN] is NULL,\nand btf_type_show() dereferences it:\n\nRIP: 0010:btf_type_show+0x223/0x2e0 kernel/bpf/btf.c:8232\nRSP: 0018:ffffc9000399f868 EFLAGS: 00010206\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000028\nRBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\nR10: ffffc9000399f970 R11: 0000000000000001 R12: ffffffff9b96b140\nR13: ffffc9000399f8e0 R14: ffff88803d393c00 R15: 0000000000000003\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000000000 CR3: 000000003d213000 CR4: 0000000000352ef0\nDR0: 0000000039ae8f55 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n btf_type_seq_show_flags+0xca/0x120 kernel/bpf/btf.c:8250\n htab_map_seq_show_elem+0x12e/0x350 kernel/bpf/hashtab.c:1669\n map_seq_show+0x13d/0x1e0 kernel/bpf/inode.c:293\n traverse.part.0.constprop.0+0x107/0x650 fs/seq_file.c:112\n traverse fs/seq_file.c:99 [inline]\n seq_read_iter+0x93f/0x1270 fs/seq_file.c:196\n seq_read+0x344/0x4d0 fs/seq_file.c:163\n vfs_read+0x1e4/0xb40 fs/read_write.c:572\n ksys_pread64 fs/read_write.c:764 [inline]\n __do_sys_pread64 fs/read_write.c:772 [inline]\n __se_sys_pread64 fs/read_write.c:769 [inline]\n __x64_sys_pread64+0x1eb/0x250 fs/read_write.c:769\n do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]\n do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nReject a key-less BTF in htab_map_check_btf() and rhtab_map_check_btf(),\nrestoring the previous behavior."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/hashtab.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"451a84a3ad3c897c03181af433e7c98640730f1f","lessThan":"54098e3fe34ec190bc256b338b9a93c7e2dc9354","versionType":"git","status":"affected"},{"version":"51a17f0ce19c4ee2a25cf16c93490d509b1ebb0a","lessThan":"fa047f2a025003f5654ebd76539f16a6ead0401a","versionType":"git","status":"affected"},{"version":"1df97a7453eec80c1912c2d0360290a3970a7671","lessThan":"7ca231252820c47aaec42a5db580db98f9b64724","versionType":"git","status":"affected"},{"version":"1df97a7453eec80c1912c2d0360290a3970a7671","lessThan":"0895a0c0734703be5532f3883c42db95615fd98b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/hashtab.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0895a0c0734703be5532f3883c42db95615fd98b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/54098e3fe34ec190bc256b338b9a93c7e2dc9354","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ca231252820c47aaec42a5db580db98f9b64724","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fa047f2a025003f5654ebd76539f16a6ead0401a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98066","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:35.667","lastModified":"2026-10-19T10:18:01.323","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: Fix potential double-free at error path\n\nThe fix for caiaq driver's resource management to handle the errors\ntries to release the resources in a common destructor call, but as a\nsashiko review for another patch suggested, some of the audio\nresources such as URBs have been already freed, and this may lead to a\ndouble-free.\n\nFor addressing the double-free, call the common destructor function\nfrom each place, and assure that the resource pointers get cleared."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/caiaq/audio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"da938aa9fc7826901921dcea225948ab21a97e45","lessThan":"ddfff1cec52b7deec6c770ba85de4dab6221d0a2","versionType":"git","status":"affected"},{"version":"09616e25f502080ba684fc7fcf959d1376ab756d","lessThan":"da93fd9002d980bb02b729c5d5aeefeb252dd110","versionType":"git","status":"affected"},{"version":"b956e48371f2ff72b76be9a829800ecec963bd45","lessThan":"b6cd6f1664a0bc8038b9baa7e6f5fe8e4142d056","versionType":"git","status":"affected"},{"version":"f537e3ad69609f6924a4db6b4a7f6561f5288bdd","lessThan":"75b20534d7a37e091db585f8b505a3b77b7e81a8","versionType":"git","status":"affected"},{"version":"6251e3e256337a30160ef59ab1580dde4d1acd28","lessThan":"2883d65a3d9a8d9a682cdb003e6ab7fb28bb17f8","versionType":"git","status":"affected"},{"version":"e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056","lessThan":"1dd715ca0568e4833ed5878f49b028b449941096","versionType":"git","status":"affected"},{"version":"28abd224db4a49560b452115bca3672a20e45b2f","lessThan":"b629ae7b3eddc6812d5af3614b8c1bd76d65fa75","versionType":"git","status":"affected"},{"version":"28abd224db4a49560b452115bca3672a20e45b2f","lessThan":"3b26ceef88c110f4d188387cffa0df78657be904","versionType":"git","status":"affected"},{"version":"096dd8519cf2f768e9e14f224b627f7aaee1a9c5","versionType":"git","status":"affected"},{"version":"5.10.258","lessThan":"5.10.271","versionType":"semver","status":"affected"},{"version":"5.15.209","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"6.1.175","lessThan":"6.1.189","versionType":"semver","status":"affected"},{"version":"6.6.140","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.12.86","lessThan":"6.12.111","versionType":"semver","status":"affected"},{"version":"6.18.27","lessThan":"6.18.53","versionType":"semver","status":"affected"},{"version":"7.0.4","lessThan":"7.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/usb/caiaq/audio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1dd715ca0568e4833ed5878f49b028b449941096","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2883d65a3d9a8d9a682cdb003e6ab7fb28bb17f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b26ceef88c110f4d188387cffa0df78657be904","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/75b20534d7a37e091db585f8b505a3b77b7e81a8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b629ae7b3eddc6812d5af3614b8c1bd76d65fa75","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6cd6f1664a0bc8038b9baa7e6f5fe8e4142d056","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da93fd9002d980bb02b729c5d5aeefeb252dd110","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ddfff1cec52b7deec6c770ba85de4dab6221d0a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98067","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:35.787","lastModified":"2026-10-21T13:21:21.163","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: disable LZ4 rolling decompression for now\n\nLZ4 rolling decompression [1] was introduced to reduce the memory\nfootprint of temporary pages:\n\n For many cases, it is needed for users to read small data within\n a compressed extent (pcluster), either due to random small read, or\n since uptodate folios (typically order-0) cannot be reused for\n decompression again since decompression algorithm refills\n already-uptodate folios.\n\nRolling decompression works because LZ4 is LZ77-based and only refers\nto the most recent 64 KiB of decompressed data, so in theory only a\nbounded rolling window of temporary pages is needed when decompressing.\n\nIt can save a lot of temporary memory, e.g.\n 601,960-byte data can be compressed into a 256k LZ4 compressed extent,\n which means it needs 146 extra pages per request in the worst case if\n rolling decompression is disabled.\n\nHowever, the upstream LZ4 implementation is not under EROFS' control:\nFor example, the literal copy memmove() may still **copy long literals\nbackward** on x86 based on the address comparison even when the source\nand destination ranges do not overlap (IOWs, inline decompression\ndoesn't need to be considered here). That breaks the rolling assumption\nand makes the optimization broken.\n\nDisable it for now to make sure the data correctness first since EROFS\nis used everywhere now: The rolling window approach can be revived once\nwe either ensure that the official LZ4 code always copies forward for\nnon-overlapping ranges or maintain our own LZ4 implementation in EROFS.\n\nThe main impact is a higher runtime memory footprint; However, recent\ncommit 0f6273ab4637 (\"erofs: add a reserved buffer pool for lz4\ndecompression\") helps mitigate this when enabled but it's still not\nperfect.\n\n[1] https://www.usenix.org/conference/atc19/presentation/gao\n    § 3.3 Decompression"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/erofs/decompressor.c","fs/erofs/internal.h","fs/erofs/zdata.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8e6c8fa9f2e95c88a642521a5da19a8e31748846","lessThan":"dcc5e6c9e4d06fe73fc61e730ee3e51dd115a4d8","versionType":"git","status":"affected"},{"version":"8e6c8fa9f2e95c88a642521a5da19a8e31748846","lessThan":"d923e53472b468a50a6cf41341531d5170c68371","versionType":"git","status":"affected"},{"version":"8e6c8fa9f2e95c88a642521a5da19a8e31748846","lessThan":"ec52dfed7b14514ed97ee71161e4cf4cfe2fbff2","versionType":"git","status":"affected"},{"version":"8e6c8fa9f2e95c88a642521a5da19a8e31748846","lessThan":"c9a2db4b9950b59c571258e4bae74c271f62dd66","versionType":"git","status":"affected"},{"version":"8e6c8fa9f2e95c88a642521a5da19a8e31748846","lessThan":"82e664cf1219c459c33aae931b222cf951af9cb7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/erofs/decompressor.c","fs/erofs/internal.h","fs/erofs/zdata.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/82e664cf1219c459c33aae931b222cf951af9cb7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9a2db4b9950b59c571258e4bae74c271f62dd66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d923e53472b468a50a6cf41341531d5170c68371","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dcc5e6c9e4d06fe73fc61e730ee3e51dd115a4d8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ec52dfed7b14514ed97ee71161e4cf4cfe2fbff2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98068","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:35.903","lastModified":"2026-10-19T10:18:01.687","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: don't let rds_conn_shutdown() consume a concurrent drop\n\nrds_conn_shutdown() finishes by moving the path from\nRDS_CONN_DISCONNECTING to RDS_CONN_DOWN, and also accepts\nRDS_CONN_ERROR as the starting state of that final transition, so that\na FIN processed in softirq context during the teardown does not derail\nthe shutdown into a noisy error path.\n\nBut consuming that RDS_CONN_ERROR also consumes the shutdown pass that\ncame with it: rds_conn_path_drop() sets RDS_CONN_ERROR and then queues\ncp_down_w, and a pass that starts on a path already in RDS_CONN_DOWN\nis a no-op.  For the FIN case that is harmless - the socket the FIN\narrived on is the very socket the teardown just released.  It is not\nharmless for a dropper that attached something to the path first.\n\nrds_tcp_accept_one() is such a dropper.  Its path claim in\nrds_tcp_accept_one_path() transitions RDS_CONN_DOWN ->\nRDS_CONN_CONNECTING, and a concurrent drop - a FIN on a previous\nsocket in softirq context, an administrative reset - can put the path\ninto RDS_CONN_ERROR between that claim and the state check that\nfollows, which accepts RDS_CONN_ERROR.  The accept then installs the\nfreshly accepted socket with rds_tcp_set_callbacks() while the queued\nteardown - which sampled tc->t_sock before this socket existed - is\nstill running.  rds_connect_path_complete() fails its transition to\nRDS_CONN_UP and drops the path again, queueing the pass that should\nreap the socket it just installed.  If the in-flight shutdown's final\ntransition consumes that drop's RDS_CONN_ERROR, the queued pass finds\nthe path in RDS_CONN_DOWN and does nothing.  The installed socket is\nnever torn down: it sits established with its callbacks armed and its\nrds_tcp_connection on rds_tcp_tc_list, the peer sees a connection that\nnothing ever reads, and the path is wedged in RDS_CONN_DOWN until some\nlater event drops it again.  Reproduced with widened race windows as\nan ever-growing receive queue on a socket owned by a path stuck in\nRDS_CONN_DOWN, with the peer's send path wedged behind it.\n\nMake the final transition only DISCONNECTING -> DOWN.  If it fails\nbecause the path is in RDS_CONN_ERROR, a drop raced the teardown:\ncancel the reconnect timer and clear RDS_RECONNECT_PENDING - the one\npiece of the skipped tail that must not be left behind - and return,\nletting the pass the drop queued finish the job: it tears down\nwhatever attached to the path in the meantime, completes the\ntransition to RDS_CONN_DOWN, and re-arms the reconnect from its own\ntail.\n\nThe timer quiesce in that branch matters because the racing drop does\nnot always queue that pass: rds_conn_path_drop() returns without\nqueueing when a destroy is pending - exactly the situation during a\nnetns teardown or module unload, when a FIN on the dying socket is\nprocessed while rds_conn_path_destroy() flushes cp_down_w.  If the\nflushed pass is the one that takes this return, no later pass exists,\nand rds_conn_path_destroy() would find cp_conn_w still armed\n(WARN_ON) and then free a path whose reconnect timer can still fire.\nWith the cancel in the branch, every exit of a shutdown pass leaves\nthe timer quiesced no matter which pass completes the transition.\n\nThe FIN case keeps making progress, one pass later and still without\nnoisy logging.  Any other state keeps today's rds_conn_path_error()\nhandling; no current cp_state writer can leave a DISCONNECTING path\nin anything but RDS_CONN_ERROR (every other writer is a cmpxchg from\na non-DISCONNECTING state), so that branch is defensive.\n\nOn kernels without the preceding patches the same hazard exists with\nthe sample-based quiesce; the fix applies there equally."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/rds/connection.c","net/rds/tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e97656d03ca0cea888a0b9d382abce8233771f31","lessThan":"f777c602d3e15d3414b53f760147687bd56b03f2","versionType":"git","status":"affected"},{"version":"e97656d03ca0cea888a0b9d382abce8233771f31","lessThan":"7cb11257aa3e5ef0bedfd5d55ac60bb00347aa97","versionType":"git","status":"affected"},{"version":"e97656d03ca0cea888a0b9d382abce8233771f31","lessThan":"4980ce260205001d582a7b3cb5eab29877777fbc","versionType":"git","status":"affected"},{"version":"e97656d03ca0cea888a0b9d382abce8233771f31","lessThan":"0ec75c69918b7f6a1a5e3fb6442925246a9ec86b","versionType":"git","status":"affected"},{"version":"e97656d03ca0cea888a0b9d382abce8233771f31","lessThan":"bd1cb197a07111ca8d4f4c21411c56a3c85a9797","versionType":"git","status":"affected"},{"version":"e97656d03ca0cea888a0b9d382abce8233771f31","lessThan":"4cb9b6d3d31a2dbaa5469981c2c4c03e9acc7aca","versionType":"git","status":"affected"},{"version":"e97656d03ca0cea888a0b9d382abce8233771f31","lessThan":"2941561395066be856a53626d4ca973dd9c982b2","versionType":"git","status":"affected"},{"version":"e97656d03ca0cea888a0b9d382abce8233771f31","lessThan":"260c6308fe2e19ad519389d44d582e292aecc3af","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/rds/connection.c","net/rds/tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0ec75c69918b7f6a1a5e3fb6442925246a9ec86b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/260c6308fe2e19ad519389d44d582e292aecc3af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2941561395066be856a53626d4ca973dd9c982b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4980ce260205001d582a7b3cb5eab29877777fbc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4cb9b6d3d31a2dbaa5469981c2c4c03e9acc7aca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cb11257aa3e5ef0bedfd5d55ac60bb00347aa97","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd1cb197a07111ca8d4f4c21411c56a3c85a9797","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f777c602d3e15d3414b53f760147687bd56b03f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98069","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:36.043","lastModified":"2026-10-19T10:18:01.887","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: acquire the fastpath locks in rds_conn_shutdown()\n\nrds_conn_shutdown() quiesces the transmit and receive-refill paths by\nwaiting for RDS_IN_XMIT and RDS_RECV_REFILL to be sampled clear, and\nthen runs the transport shutdown and rds_conn_path_reset().  Sampling\nthe bits clear is not the same as owning them: the moment after the\nwait_event() returns, rds_send_xmit() can re-acquire RDS_IN_XMIT (or\nrds_ib_recv_refill() can re-acquire RDS_RECV_REFILL) and run\nconcurrently with the teardown.\n\nThe sender does recheck the connection state after taking the lock,\nbut that recheck is a classic store-buffering pattern: teardown writes\nthe state and reads the bit while the sender writes the bit and reads\nthe state.  acquire_in_xmit() is only an acquire operation, so on\nweakly ordered architectures both sides can miss each other's write,\nand the transmit path then runs while the transport zeroes its rings\n(e.g. rds_ib_ring_init()) and rds_send_path_reset() rewrites the\ntransmit state under it.\n\nOracle UEK fixed the same class of crashes - a 14-year tail of\nBUG_ON()s in rds_ib_sub_signaled(), unexpected op-codes and NULL\ndereferences in rds_ib_send_cqe_handler() during failover testing -\nby making the teardown path *acquire* the fastpath bit locks instead\nof testing them (\"rds: Make sure transmit path and connection\ntear-down does not run concurrently\").  Ownership of a single word is\ndecided by RMW atomicity, so no cross-variable ordering is needed.\n\nDo the same here: take both locks before calling the transport\nshutdown, hold them across rds_conn_path_reset(), and release them\nexplicitly with a wake-up afterwards.  Both are released with\nclear_bit_unlock(), so that the ring re-initialization done by the\ntransport shutdown and the transmit state rewritten by\nrds_send_path_reset() are ordered before either bit is seen clear by\nthe next acquire_in_xmit() or acquire_refill().\n\nThe fastpath users of these bits - rds_send_xmit() and\nrds_ib_recv_refill() - are trylock style and back off while teardown\nowns the locks, so no new lock dependency is introduced for them.\nrds_tcp_reset_callbacks() is different: since the previous patch it\nacquires RDS_IN_XMIT as well, and it blocks doing so, so its wait now\nspans the teardown instead of at most one send batch.  That waiter\nruns from rds_tcp_accept_one() on the single-threaded krdsd workqueue\nand holds rds_tcp_accept_lock and t_conn_path_lock while it waits, so\na duelling SYN accepted while its path is being torn down parks\naccept processing for the duration of the teardown - for TCP bounded\nby the (up to 5 s) drain loop in rds_tcp_conn_path_shutdown().  An IB\npath's drain in rds_ib_conn_path_shutdown() has no round cap, but no\nblocking waiter either: rds_tcp_reset_callbacks() is the only blocking\nacquirer of these bits and waits only on its own TCP path, and the\nfastpaths are trylock-and-back-off on both transports, so a long IB\ndrain lengthens only that path's own quiesce.  The\nwindow is narrow: the accept-side state check has to pass before the\nteardown moves the path to RDS_CONN_DISCONNECTING.\n\nBecause krdsd is a single global workqueue, everything else queued\nthere - accept processing for other connections and network\nnamespaces, and the flush_workqueue(rds_wq) in rds_tcp_listen_stop()\nduring namespace teardown - waits behind the parked accept worker for\nthat time.  It cannot deadlock, although the waits do point at each\nother: the teardown blocks until the bit's holder releases it, and\nthe holder may be that krdsd accept worker.  The holder finishes\nwithout needing anything the teardown owns: the sync cancels\nrds_tcp_reset_callbacks() issues target cp_send_w and cp_recv_w on\nthe path's ordered cp_wq, whose only execution slot is occupied by\nthe blocked cp_down_w itself, so they are pending at most and cancel\nwithout flushing - a reliance on cp_wq being ordered that is now\nnoted next to those cancels (on \n---truncated---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/rds/connection.c","net/rds/ib_recv.c","net/rds/send.c","net/rds/tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0f4b1c7e89e699f588807a914ec6e6396c851a72","lessThan":"7f4f21e4439df30d9aca9fb3bac38191a2f34729","versionType":"git","status":"affected"},{"version":"0f4b1c7e89e699f588807a914ec6e6396c851a72","lessThan":"1f900f585cbb0fbe6aa00c31c9f5bb63ee614456","versionType":"git","status":"affected"},{"version":"0f4b1c7e89e699f588807a914ec6e6396c851a72","lessThan":"32e21bcf4b5b11454bf57c4bb3bf019b71512ace","versionType":"git","status":"affected"},{"version":"0f4b1c7e89e699f588807a914ec6e6396c851a72","lessThan":"2e46248e375a516301884719f08b6015c79a6456","versionType":"git","status":"affected"},{"version":"0f4b1c7e89e699f588807a914ec6e6396c851a72","lessThan":"7febb113795d5de5b690b208f4b0e64a5fad1201","versionType":"git","status":"affected"},{"version":"0f4b1c7e89e699f588807a914ec6e6396c851a72","lessThan":"900e96c9749a06833801f60c393aa1d405ea226c","versionType":"git","status":"affected"},{"version":"0f4b1c7e89e699f588807a914ec6e6396c851a72","lessThan":"1fe627e5db5c3f53a9f9f9c8a66671755d306955","versionType":"git","status":"affected"},{"version":"0f4b1c7e89e699f588807a914ec6e6396c851a72","lessThan":"813f3582ac7ae9f60f917937d54660e0952d5f2d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/rds/connection.c","net/rds/ib_recv.c","net/rds/send.c","net/rds/tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.37","status":"affected"},{"version":"0","lessThan":"2.6.37","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1f900f585cbb0fbe6aa00c31c9f5bb63ee614456","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1fe627e5db5c3f53a9f9f9c8a66671755d306955","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2e46248e375a516301884719f08b6015c79a6456","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/32e21bcf4b5b11454bf57c4bb3bf019b71512ace","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f4f21e4439df30d9aca9fb3bac38191a2f34729","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7febb113795d5de5b690b208f4b0e64a5fad1201","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/813f3582ac7ae9f60f917937d54660e0952d5f2d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/900e96c9749a06833801f60c393aa1d405ea226c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98070","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:36.193","lastModified":"2026-10-19T10:18:02.123","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()\n\nrds_tcp_reset_callbacks() quiesces the transmit path by setting the\npath state to RDS_CONN_RESETTING and then waiting for RDS_IN_XMIT to\nbe sampled clear before swapping the underlying socket and calling\nrds_send_path_reset().\n\nSampling the bit clear is not the same as owning it: rds_send_xmit()\ncan re-acquire RDS_IN_XMIT right after the wait_event() returns.  Its\nstate recheck after taking the lock is a store-buffering pattern (the\nresetter writes the state and reads the bit, the sender writes the\nbit and reads the state) and acquire_in_xmit() is only an acquire\noperation, so on weakly ordered architectures both sides can miss\neach other's write and the transmit path then runs concurrently with\nrds_send_path_reset() rewriting cp_xmit_* state - which is exactly\nwhat the comment above rds_send_path_reset() tells its callers to\nprevent.\n\nTake the lock instead, hold it across the socket swap and\nrds_send_path_reset(), and release it with a wake-up at the end.  The\nlock-ordering constraint documented above the wait still holds: the\nlock is acquired before lock_sock(), so a sender inside tcp_sendmsg()\ncan never be waited on while we hold the socket lock.\n\nTwo details of the old code go away with the same change:\n\n - t_sock is now read only after the lock is acquired.  The old code\n   cached it before waiting; the teardown in rds_conn_shutdown()\n   releases that socket and clears t_sock, so a pointer cached before\n   the wait can be stale by the time the accept path resumes.  Reading\n   it under RDS_IN_XMIT is what makes the exclusion complete once the\n   teardown owns the same lock, which the next patch arranges; until\n   then the teardown still only samples the bit, and the two paths\n   remain as exposed to each other as they are today.\n\n - The old !osock early path called rds_send_path_reset() with no\n   serialization at all.  It now runs under the lock like the normal\n   path.  The conditional RDS_CONN_RESETTING transition of the\n   previous patch happens before the socket check either way: a path\n   found without a socket is either still connecting (its reconnect\n   worker blocked on t_conn_path_lock) and legitimately goes\n   RESETTING -> UP on the new socket, or it has been torn down\n   meanwhile and is dropped.\n\nThe in-function comment describing the old wait-based quiesce is\nrewritten to describe the lock-based one, and the stale block comment\nabove the function (which still described a return value and an\nincomplete list of t_sock writers) is refreshed to name all four\nwriters - the connect, accept, teardown and swap paths - and what\nserializes each of them."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/rds/tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"670af4e4a4de5e6bb5daee3838485571a0caa5fa","versionType":"git","status":"affected"},{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"830a2e21b200c6b6fdccc63dd3f23932bf7a894b","versionType":"git","status":"affected"},{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"a05790cb4ff03f797d76906990b148d83f63e7a3","versionType":"git","status":"affected"},{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"d184e6dd4b8f3c20c018595fd09795a66b46c8ef","versionType":"git","status":"affected"},{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"d625112564c3e980e02504270222b49b82690cee","versionType":"git","status":"affected"},{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"8e4c3b7844c906c7097b4cfedd9dd1f48c9a6a92","versionType":"git","status":"affected"},{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"062d9e008c67289e8e1b221ecdd8f9d60566d012","versionType":"git","status":"affected"},{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"02c5f9dc2efd823e061954d564ce00bacd1bebeb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/rds/tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/02c5f9dc2efd823e061954d564ce00bacd1bebeb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/062d9e008c67289e8e1b221ecdd8f9d60566d012","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/670af4e4a4de5e6bb5daee3838485571a0caa5fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/830a2e21b200c6b6fdccc63dd3f23932bf7a894b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e4c3b7844c906c7097b4cfedd9dd1f48c9a6a92","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a05790cb4ff03f797d76906990b148d83f63e7a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d184e6dd4b8f3c20c018595fd09795a66b46c8ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d625112564c3e980e02504270222b49b82690cee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98071","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:36.327","lastModified":"2026-10-19T10:18:02.350","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: clear cp_flags bits individually in rds_conn_path_reset()\n\nrds_conn_path_reset() wipes the whole flag word with a plain\ncp->cp_flags = 0 store.  Every other accessor of that word uses\natomic bitops, and some of them can run concurrently with the reset:\nRDS_LL_SEND_FULL is set from rds_send_xmit() and cleared from the\ntransport completion paths, neither of which holds anything that\nexcludes the shutdown worker.  A plain store racing an atomic\nread-modify-write on the same word is a data race, and whichever\nside loses has its update silently discarded.\n\nClear the two bits the reset is actually responsible for instead.\nRDS_IN_XMIT and RDS_RECV_REFILL need no store at all here: they\nbelong to the caller, rds_conn_shutdown(), which waits for both to be\nclear before calling the transport shutdown and this reset.\n\nThis also gives every bit in cp_flags a single well-defined writer\ndiscipline, which the following patches rely on when they turn\nRDS_IN_XMIT and RDS_RECV_REFILL into bit locks held across the\nteardown: a blanket store mid-teardown would destroy lock ownership\nthat an atomic clear preserves.\n\nOracle UEK carries the same conversion (\"net/rds: Preserve essential\nconnection state flags\"), motivated by its asynchronous shutdown\nstate machine, whose progress and destroy flags must survive the\nreset.  UEK's variant also clears RDS_IN_XMIT and RDS_RECV_REFILL\nbecause there the reset runs as the final step of a teardown that\nowns both bits, making those clears its unlock.  Upstream that\nrelease belongs in rds_conn_shutdown(): once a later patch in this\nseries turns the two bits into locks held across the teardown, ending\nownership needs release semantics and a wake-up that a plain clear\ninside the reset would not provide.\n\nBased on Oracle UEK commit \"net/rds: Preserve essential connection\nstate flags\" by Gerd Rausch."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/rds/connection.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"00e0f34c616603ba6500f41943cbf89eb4a8a5be","lessThan":"c9a7c1eb0ad41dcf004a9e870e452cafedcd9172","versionType":"git","status":"affected"},{"version":"00e0f34c616603ba6500f41943cbf89eb4a8a5be","lessThan":"b767b48614c38687d717082860de7aa46f3b142c","versionType":"git","status":"affected"},{"version":"00e0f34c616603ba6500f41943cbf89eb4a8a5be","lessThan":"b7dc5da660eb5ffa7f7b4d33f2c74cb71c6edd6c","versionType":"git","status":"affected"},{"version":"00e0f34c616603ba6500f41943cbf89eb4a8a5be","lessThan":"b8a8b6d25e7426a638c60eaba2129c0664131e84","versionType":"git","status":"affected"},{"version":"00e0f34c616603ba6500f41943cbf89eb4a8a5be","lessThan":"ed3ee0ac4aafda50c2f4381eb973beefeb7879ac","versionType":"git","status":"affected"},{"version":"00e0f34c616603ba6500f41943cbf89eb4a8a5be","lessThan":"6b8d7563c28b8112e6e54abe413b028ef3f8c549","versionType":"git","status":"affected"},{"version":"00e0f34c616603ba6500f41943cbf89eb4a8a5be","lessThan":"cb62aa8f04655a4df487913949719c0a1266ed73","versionType":"git","status":"affected"},{"version":"00e0f34c616603ba6500f41943cbf89eb4a8a5be","lessThan":"103c4b13c4f50322910078d1c02f29334a574122","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/rds/connection.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","lessThan":"2.6.30","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/103c4b13c4f50322910078d1c02f29334a574122","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b8d7563c28b8112e6e54abe413b028ef3f8c549","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b767b48614c38687d717082860de7aa46f3b142c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b7dc5da660eb5ffa7f7b4d33f2c74cb71c6edd6c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8a8b6d25e7426a638c60eaba2129c0664131e84","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9a7c1eb0ad41dcf004a9e870e452cafedcd9172","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cb62aa8f04655a4df487913949719c0a1266ed73","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed3ee0ac4aafda50c2f4381eb973beefeb7879ac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98072","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:36.450","lastModified":"2026-10-19T10:18:02.543","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: use wq_has_sleeper() in release_in_xmit()\n\nrelease_in_xmit() clears RDS_IN_XMIT with clear_bit_unlock() and then\nchecks waitqueue_active() to decide whether anyone needs waking.\nclear_bit_unlock() is only a release operation: it orders the\ncritical section before the bit clear, but does not order the\nsubsequent plain load of the wait queue head after it.  The waiter\nside does the mirror image - it adds itself to the wait queue and\nthen tests the bit.  That is the classic store-buffering pattern: the\nreleasing CPU can read the wait queue as empty while the waiting CPU\nstill reads the bit as set, so the sleeper is never woken.\n\nThe waiters are rds_conn_shutdown() and rds_tcp_reset_callbacks(),\nboth in uninterruptible wait_event() with no timeout.  A lost wake-up\nstrands the shutdown worker on its single-threaded workqueue until\nsome other sender releases the bit again - and on a connection that\nis being torn down precisely because it failed, there may never be\nanother sender.\n\nThe barrier used to be there: release_in_xmit() did clear_bit()\nfollowed by smp_mb__after_atomic() until commit 1422f28826d2 (\"rds:\nintroduce acquire/release ordering in acquire/release_in_xmit()\")\nfolded both into clear_bit_unlock(), which strengthened the lock\nhand-off but silently dropped the full barrier the wake-up check\ndepends on.  The refill counterpart, release_refill() in\nnet/rds/ib_recv.c, still carries its smp_mb__after_atomic() for\nexactly this reason.\n\nUse wq_has_sleeper(), which is waitqueue_active() preceded by the\nrequired full barrier."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/rds/send.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1e1e4316fcaeb9cd6bc56c91127e88625237dd44","lessThan":"6f552364d97cf4005c7a58f11c9f79e14e269865","versionType":"git","status":"affected"},{"version":"8c378cc522aedd5fa5aa53486b43a4d552fbbd5c","lessThan":"a94b1dfc82454c5bc068e71c25393af674daf63b","versionType":"git","status":"affected"},{"version":"52287ed416a10bc3d3e204a3186d9509ab3ee634","lessThan":"5a806ed1eb46850ca4159a18b2a8c4b70f0c1341","versionType":"git","status":"affected"},{"version":"4a4dffdff9ea6201665f5d0a5042011d09bd527f","lessThan":"3d401934b7edb3ccb07d982dabadd04c45ee307c","versionType":"git","status":"affected"},{"version":"1422f28826d2a0c11e5240b3e951c9e214d8656e","lessThan":"ed7ee0cd0e136d02f87f13181b1a89880463c7e9","versionType":"git","status":"affected"},{"version":"1422f28826d2a0c11e5240b3e951c9e214d8656e","lessThan":"a269795107f45adc95975a83324f8fef40bec4ce","versionType":"git","status":"affected"},{"version":"1422f28826d2a0c11e5240b3e951c9e214d8656e","lessThan":"3764627b30a283e611e652c4a2bb8cdc74a75a99","versionType":"git","status":"affected"},{"version":"1422f28826d2a0c11e5240b3e951c9e214d8656e","lessThan":"6d0c8b7073913011459cf968cbbadd341e166bc3","versionType":"git","status":"affected"},{"version":"bec6c4ce1169a565c58c347d5d0ac22e46d507d6","versionType":"git","status":"affected"},{"version":"f781fb5177cdfd9a6c98cd94e30275457c6461ac","versionType":"git","status":"affected"},{"version":"917135195200e20e5244b9c3f2bb40f3d5e02510","versionType":"git","status":"affected"},{"version":"d792459a6e2ae21c7f5107babd63e52e4c5ab93a","versionType":"git","status":"affected"},{"version":"5.10.214","lessThan":"5.10.271","versionType":"semver","status":"affected"},{"version":"5.15.153","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"6.1.83","lessThan":"6.1.189","versionType":"semver","status":"affected"},{"version":"6.6.23","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"4.19.311","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.273","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"6.7.11","lessThan":"6.8","versionType":"semver","status":"affected"},{"version":"6.8.2","lessThan":"6.9","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/rds/send.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3764627b30a283e611e652c4a2bb8cdc74a75a99","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3d401934b7edb3ccb07d982dabadd04c45ee307c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5a806ed1eb46850ca4159a18b2a8c4b70f0c1341","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d0c8b7073913011459cf968cbbadd341e166bc3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f552364d97cf4005c7a58f11c9f79e14e269865","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a269795107f45adc95975a83324f8fef40bec4ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a94b1dfc82454c5bc068e71c25393af674daf63b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed7ee0cd0e136d02f87f13181b1a89880463c7e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98073","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:36.593","lastModified":"2026-10-21T13:21:21.343","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Remove conflicting altnames for dying netns in __dev_change_net_namespace().\n\nsyzbot reported the warning in cfg80211_pernet_exit(). [0]\n\nThe repro does the following:\n\n  1. create two device in root netns and non-root netns\n  2. assign the same altname for the two devices\n  3. remove the non-root netns\n\nSince commit 7663d522099e (\"net: check for altname conflicts\nwhen changing netdev's netns\"), cfg80211_switch_netns() and\ncfg802154_switch_netns() fail if init_net has a device with the\nconflicting altname.\n\ndefault_device_exit_net() had the same issue and commit d09486a04f5d\n(\"net: fix removing a namespace with conflicting altnames\") fixed it.\n\ncfg80211_pernet_exit() and cfg802154_pernet_exit() need the same fix.\n\nLet's generalise the fix by removing conflicting altnames for dying\nnetns in __dev_change_net_namespace().\n\n[0]:\ncfg80211_switch_netns(rdev, &init_net)\nWARNING: net/wireless/core.c:1871 at cfg80211_pernet_exit+0xd5/0x120 net/wireless/core.c:1871, CPU#1: kworker/u8:9/1160\nModules linked in:\nCPU: 1 UID: 0 PID: 1160 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026\nWorkqueue: netns cleanup_net\nRIP: 0010:cfg80211_pernet_exit+0xd5/0x120 net/wireless/core.c:1871\nCode: e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 b4 ef 0e f7 4d 8b 36 49 81 fe 20 10 4a 90 74 12 e8 03 3d 9f f6 eb 85 e8 fc 3c 9f f6 90 <0f> 0b 90 eb cc e8 f1 3c 9f f6 eb 05 e8 ea 3c 9f f6 5b 41 5c 41 5e\nRSP: 0018:ffffc900057a78f0 EFLAGS: 00010293\nRAX: ffffffff8b287154 RBX: ffff88807ba72780 RCX: ffff8880213e8000\nRDX: 0000000000000000 RSI: 00000000ffffffef RDI: 0000000000000000\nRBP: 00000000ffffffef R08: ffffffff9024cc67 R09: 0000000000000000\nR10: fffff52000af4eb0 R11: fffffbfff204998d R12: dffffc0000000000\nR13: ffffffff904a1080 R14: ffff888144ed0008 R15: ffff888144ed0e20\nFS:  0000000000000000(0000) GS:ffff888124de6000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005642de0a8a70 CR3: 000000007a40c000 CR4: 00000000003526f0\nCall Trace:\n <TASK>\n ops_exit_list net/core/net_namespace.c:200 [inline]\n ops_undo_list+0x43d/0x8d0 net/core/net_namespace.c:253\n cleanup_net+0x572/0x810 net/core/net_namespace.c:706\n process_one_work kernel/workqueue.c:3387 [inline]\n process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470\n worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551\n kthread+0x38b/0x480 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n </TASK>"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/core/dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc","lessThan":"54772bf503dd0e81e8b8db537fee6946de81e717","versionType":"git","status":"affected"},{"version":"36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc","lessThan":"119ac1716705af17fb74b3e33058a938a87eecd4","versionType":"git","status":"affected"},{"version":"36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc","lessThan":"a29ea5b5034654aaaa4aadd771f48c01abfd2dfa","versionType":"git","status":"affected"},{"version":"36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc","lessThan":"ac6631843269e6a9b2164e393b7f729328711d78","versionType":"git","status":"affected"},{"version":"36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc","lessThan":"debac3a20dec524a59625cf10fa2f18571127824","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/core/dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.5","status":"affected"},{"version":"0","lessThan":"5.5","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/119ac1716705af17fb74b3e33058a938a87eecd4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/54772bf503dd0e81e8b8db537fee6946de81e717","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a29ea5b5034654aaaa4aadd771f48c01abfd2dfa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac6631843269e6a9b2164e393b7f729328711d78","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/debac3a20dec524a59625cf10fa2f18571127824","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98074","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:36.730","lastModified":"2026-10-19T10:18:02.950","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: do not clear curr_active_slave prematurely when releasing all slaves\n\nWhen releasing all slaves during bond destruction (all == true),\n__bond_release_one() unconditionally clears bond->curr_active_slave to\nNULL in every iteration.\n\nIf a backup slave is released before the active slave,\nbond_alb_deinit_slave() triggers rlb_teach_disabled_mac_on_primary(),\nwhich increments the active slave dev promiscuity counter and sets\nbond_info->primary_is_promisc = 1.\n\nBecause bond->curr_active_slave was prematurely cleared to NULL when\nreleasing the backup slave, the subsequent iteration releasing the active\nslave evaluates oldcurrent as NULL, so bond_change_active_slave(bond, NULL)\nis skipped. Consequently, bond_alb_handle_active_change() is never called\nto decrement the promiscuity counter, permanently leaking promiscuous\nmode on the physical device after bond teardown.\n\nWhen oldcurrent == slave, bond_change_active_slave(bond, NULL) already sets\nbond->curr_active_slave to NULL. We only need to avoid selecting a new\nactive slave when all == true. Replace the if (all) branch with\nif (!all && oldcurrent == slave)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/bonding/bond_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0896341a44bf04bf6149d9307fe4686006f3eee1","lessThan":"b1ded242135071769902778dbab081e3fc09730f","versionType":"git","status":"affected"},{"version":"0896341a44bf04bf6149d9307fe4686006f3eee1","lessThan":"e39b203ec9e73852098d41b26386172d51babeb9","versionType":"git","status":"affected"},{"version":"0896341a44bf04bf6149d9307fe4686006f3eee1","lessThan":"384739c631aa6749356ba062d6b7c9a484a733f6","versionType":"git","status":"affected"},{"version":"0896341a44bf04bf6149d9307fe4686006f3eee1","lessThan":"7b435c69a30b40efc642de98b9bfa95fcf2ad4f0","versionType":"git","status":"affected"},{"version":"0896341a44bf04bf6149d9307fe4686006f3eee1","lessThan":"d6ef22e79c2be3612868daede0e9a84f05439d9e","versionType":"git","status":"affected"},{"version":"0896341a44bf04bf6149d9307fe4686006f3eee1","lessThan":"19ba7ecfade159b3702c78a360fd7d971e2b7109","versionType":"git","status":"affected"},{"version":"0896341a44bf04bf6149d9307fe4686006f3eee1","lessThan":"6d0ee411d5437f3d126ea6979acb83a8da29dc81","versionType":"git","status":"affected"},{"version":"0896341a44bf04bf6149d9307fe4686006f3eee1","lessThan":"af602c7aa5fedc9be3043244017aef4f26c96b70","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/bonding/bond_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.9","status":"affected"},{"version":"0","lessThan":"3.9","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/19ba7ecfade159b3702c78a360fd7d971e2b7109","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/384739c631aa6749356ba062d6b7c9a484a733f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d0ee411d5437f3d126ea6979acb83a8da29dc81","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7b435c69a30b40efc642de98b9bfa95fcf2ad4f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af602c7aa5fedc9be3043244017aef4f26c96b70","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1ded242135071769902778dbab081e3fc09730f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6ef22e79c2be3612868daede0e9a84f05439d9e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e39b203ec9e73852098d41b26386172d51babeb9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98075","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:36.847","lastModified":"2026-10-19T10:18:03.130","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: reject BPF_PSEUDO_FUNC reference to the main program\n\nfixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real\nfunction addresses. This function is invoked from bpf_jit_subprogs()\nonly when env->subprog_cnt > 1. Meaning that for any program like\nbelow:\n\n  int main(void *ctx) {\n    void *ptr = main;\n    ...\n    bpf_timer_set_callback(..., ptr);\n    ...\n  }\n\nThe 'ptr' won't be ever converted to contain an address.\nIn combination with e.g. bpf_timer_set_callback() this would lead to a\nfunction call at a bogus address.\n\nInstead of complicating the implementation, just assume that no useful\nprogram needs main to be a sync or async callback and reject\nBPF_PSEUDO_FUNC loads for the main subprogram."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"69c087ba6225b574afb6e505b72cb75242a3d844","lessThan":"c74750dca96f40a1adb9d334f5a3152f44b270c3","versionType":"git","status":"affected"},{"version":"69c087ba6225b574afb6e505b72cb75242a3d844","lessThan":"314c8caa9cb64ad60c5b969fe9a3e2dcdccf156f","versionType":"git","status":"affected"},{"version":"69c087ba6225b574afb6e505b72cb75242a3d844","lessThan":"8cb75f7ada25b1cf25f2f74dec3ba649b9064a09","versionType":"git","status":"affected"},{"version":"69c087ba6225b574afb6e505b72cb75242a3d844","lessThan":"118212417ba0120d99f84154799f8880f07411f4","versionType":"git","status":"affected"},{"version":"69c087ba6225b574afb6e505b72cb75242a3d844","lessThan":"d6c39774ae093c9f7009cc4ae918f18fc1af7ae7","versionType":"git","status":"affected"},{"version":"69c087ba6225b574afb6e505b72cb75242a3d844","lessThan":"92f0bd0e2b632c6565ac2214a4d7d2ed37e5b9f6","versionType":"git","status":"affected"},{"version":"69c087ba6225b574afb6e505b72cb75242a3d844","lessThan":"374b2c5561db80fcdd7cdce44af37a49416f61c7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/118212417ba0120d99f84154799f8880f07411f4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/314c8caa9cb64ad60c5b969fe9a3e2dcdccf156f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/374b2c5561db80fcdd7cdce44af37a49416f61c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8cb75f7ada25b1cf25f2f74dec3ba649b9064a09","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/92f0bd0e2b632c6565ac2214a4d7d2ed37e5b9f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c74750dca96f40a1adb9d334f5a3152f44b270c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6c39774ae093c9f7009cc4ae918f18fc1af7ae7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98076","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:36.963","lastModified":"2026-10-19T10:18:03.277","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/probes: Fix use-after-free on field name/type of events with multiple probes\n\nThe fields of a probe-based dynamic event (kprobe, uprobe, eprobe and\nfprobe events) are created in traceprobe_define_arg_fields() by handing\nthe probe_arg name/type strings to trace_define_field(), which only\nstores the pointers without copying. Those strings are owned by the\ntrace_probe and are freed when that probe is removed.\n\nAn event can have several probes attached. The field list is defined\nonly once, by the first probe that registers the event, but it is kept\nalive by any surviving sibling probe. Deleting just that first probe by\nsymbol -\n\n  # primary A: fields are defined from A's args\n  echo 'p:kprobes/ev vfs_read  a1=$arg1' >  kprobe_events\n  # append B: shares A's event call\n  echo 'p:kprobes/ev vfs_write a1=$arg1' >> kprobe_events\n  # delete only A (matched by symbol), B survives\n  echo '-:kprobes/ev vfs_read'           >> kprobe_events\n\nfrees A's args (trace_probe_cleanup() -> traceprobe_free_probe_arg()),\nbut trace_probe_unlink() keeps the trace_probe_event because the probe\nlist is not empty. The event call stays registered via B while its\nfields now reference freed memory. Any field lookup then reads it, e.g.\n\n  echo 'a1 == 1' > events/kprobes/ev/filter\n\n  BUG: KASAN: slab-use-after-free in strcmp+0xa7/0xb0\n  Call Trace:\n   strcmp\n   trace_find_event_field\n   parse_pred\n   process_preds\n   create_filter\n   apply_event_filter\n   event_filter_write\n\nfield->name references parg->name (kstrdup'd, freed with the probe) and,\nfor array arguments, field->type references parg->fmt (kmalloc'd, freed\nwith the probe) - the scalar type otherwise points at the static\nfmttype rodata, which is safe.\n\nHave traceprobe_define_arg_fields() duplicate the name and type strings\nand anchor the copies on the trace_probe_event, which embeds the event\ncall and outlives every individual probe; trace_probe_event_free()\nreleases them.\n\nThe reproducer above triggers reliably; the field lookup and the delete\nboth run under event_mutex, so this is a dangling reference after\nremoval rather than a race.\n\nThe issue was found by the autokbug dynamic kernel fuzzer at Tencent\nYunding Lab."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_probe.c","kernel/trace/trace_probe.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ca89bc071d5e4e981dcc52e0ca90f4500d332e42","lessThan":"38305e1b8b1ec27eef8f2d4e461e3b6c8624d494","versionType":"git","status":"affected"},{"version":"ca89bc071d5e4e981dcc52e0ca90f4500d332e42","lessThan":"6d6118c17bc791594cbfd9cc4936ee21073b894a","versionType":"git","status":"affected"},{"version":"ca89bc071d5e4e981dcc52e0ca90f4500d332e42","lessThan":"a2510fcaad92b09b34574c97e8356234c6a84a9a","versionType":"git","status":"affected"},{"version":"ca89bc071d5e4e981dcc52e0ca90f4500d332e42","lessThan":"9379e193826f23876daccb3351fab89c87084ba3","versionType":"git","status":"affected"},{"version":"ca89bc071d5e4e981dcc52e0ca90f4500d332e42","lessThan":"68ae584169c7a41fc9bc4677c1d368983cf44b21","versionType":"git","status":"affected"},{"version":"ca89bc071d5e4e981dcc52e0ca90f4500d332e42","lessThan":"411c9080a776577664531b4f7d3ee53b7a747ba8","versionType":"git","status":"affected"},{"version":"ca89bc071d5e4e981dcc52e0ca90f4500d332e42","lessThan":"178ff2e011e21fbebdf57f5d58a408fe59136d82","versionType":"git","status":"affected"},{"version":"ca89bc071d5e4e981dcc52e0ca90f4500d332e42","lessThan":"86b7a239ec6b14a7544200ede85474c6f5526049","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_probe.c","kernel/trace/trace_probe.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/178ff2e011e21fbebdf57f5d58a408fe59136d82","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38305e1b8b1ec27eef8f2d4e461e3b6c8624d494","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/411c9080a776577664531b4f7d3ee53b7a747ba8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68ae584169c7a41fc9bc4677c1d368983cf44b21","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d6118c17bc791594cbfd9cc4936ee21073b894a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/86b7a239ec6b14a7544200ede85474c6f5526049","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9379e193826f23876daccb3351fab89c87084ba3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a2510fcaad92b09b34574c97e8356234c6a84a9a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98077","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:37.090","lastModified":"2026-10-19T10:18:03.470","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()\n\nsip_skip_whitespace() returns dptr unchanged when its own loop\nexhausts the buffer (dptr == limit), instead of NULL like its sibling\nsip_follow_continuation() returns on its own \"no more data\" path.\n\nct_sip_get_header() only checks for NULL after calling it:\n\n  dptr = sip_skip_whitespace(dptr, limit);\n  if (dptr == NULL)\n          break;\n  if (*dptr != ':' || ++dptr >= limit)\n          break;\n\nso a recognized header name followed only by spaces/tabs running to\nthe exact end of the SIP payload, with no colon, makes the very next\nstatement read one byte past the buffer.\n\nMake both \"no more data\" outcomes return NULL, matching the\nconvention sip_follow_continuation() already uses and that both\nexisting callers already check for."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nf_conntrack_sip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ea45f12a2766dae54e5426a23e8f4bafdbe2782e","lessThan":"9ae0a87e6f513293677fe286729fbae34d592215","versionType":"git","status":"affected"},{"version":"ea45f12a2766dae54e5426a23e8f4bafdbe2782e","lessThan":"b6277622b7323000895b674321c9a1f060553188","versionType":"git","status":"affected"},{"version":"ea45f12a2766dae54e5426a23e8f4bafdbe2782e","lessThan":"0cfb96a118c5c6d46d7a1cfdfa18355ad734ca79","versionType":"git","status":"affected"},{"version":"ea45f12a2766dae54e5426a23e8f4bafdbe2782e","lessThan":"c6beb08b1a9fdb96795816d8329ed75dd785d48e","versionType":"git","status":"affected"},{"version":"ea45f12a2766dae54e5426a23e8f4bafdbe2782e","lessThan":"60c012b2d05e1558b0f30ea3f15a2c3ca2f24d94","versionType":"git","status":"affected"},{"version":"ea45f12a2766dae54e5426a23e8f4bafdbe2782e","lessThan":"4be8380e3af008f418f97992c06f23be649a430d","versionType":"git","status":"affected"},{"version":"ea45f12a2766dae54e5426a23e8f4bafdbe2782e","lessThan":"4a30aa2ba007db18210dd52219ecbd5528c03523","versionType":"git","status":"affected"},{"version":"ea45f12a2766dae54e5426a23e8f4bafdbe2782e","lessThan":"e8f8231824b5815f57ce62cba116e511b10196de","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/nf_conntrack_sip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.26","status":"affected"},{"version":"0","lessThan":"2.6.26","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0cfb96a118c5c6d46d7a1cfdfa18355ad734ca79","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a30aa2ba007db18210dd52219ecbd5528c03523","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4be8380e3af008f418f97992c06f23be649a430d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/60c012b2d05e1558b0f30ea3f15a2c3ca2f24d94","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9ae0a87e6f513293677fe286729fbae34d592215","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6277622b7323000895b674321c9a1f060553188","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c6beb08b1a9fdb96795816d8329ed75dd785d48e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8f8231824b5815f57ce62cba116e511b10196de","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98078","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:37.200","lastModified":"2026-10-19T10:18:03.640","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix reversed sequence option serialization\n\nhton_seq() expects the host-order source first and the unaligned\nnetwork-order destination second. The version 1 sync sender passes these\narguments in reverse for both sequence blocks. This leaves 24 bytes of the\nkmalloc-backed message unwritten. It may disclose stale heap data and\nreplace the live connection sequence state with values read from the\nbuffer.\n\nPass the connection sequence state as the source and the message payload as\nthe destination for both blocks."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/ipvs/ip_vs_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"986a075795339c5ea1122ce9290dfd5504252eb0","lessThan":"ae38b2ae16f709c0193e1b4340bde26ef3e2687d","versionType":"git","status":"affected"},{"version":"986a075795339c5ea1122ce9290dfd5504252eb0","lessThan":"bbc68ba258a4eb0a2ca3b3a105550801aa8b00b0","versionType":"git","status":"affected"},{"version":"986a075795339c5ea1122ce9290dfd5504252eb0","lessThan":"f487b5788f15c6c32a219ed1480d25c93fc18d30","versionType":"git","status":"affected"},{"version":"986a075795339c5ea1122ce9290dfd5504252eb0","lessThan":"677ff8ab30a663cde984d8afe86465fd0d81aeef","versionType":"git","status":"affected"},{"version":"986a075795339c5ea1122ce9290dfd5504252eb0","lessThan":"e1c9f9446d3eaae323f1689f9e5de3b1ad6e47ec","versionType":"git","status":"affected"},{"version":"986a075795339c5ea1122ce9290dfd5504252eb0","lessThan":"524599714558da83747c04952d378155c69f5b6b","versionType":"git","status":"affected"},{"version":"986a075795339c5ea1122ce9290dfd5504252eb0","lessThan":"de6cc6ec7932bc530f2bb92005dac9123d50659c","versionType":"git","status":"affected"},{"version":"986a075795339c5ea1122ce9290dfd5504252eb0","lessThan":"b04578b74f2d3755548fe9e829e3b2a6c6f966a1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/ipvs/ip_vs_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.39","status":"affected"},{"version":"0","lessThan":"2.6.39","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":2.5}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"6.12.111","matchCriteriaId":"BD9C63A1-0F83-4608-A35B-28036F575997"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*","matchCriteriaId":"14FD7B9A-4946-4511-8E63-6E13870CD4A8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/524599714558da83747c04952d378155c69f5b6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/677ff8ab30a663cde984d8afe86465fd0d81aeef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/ae38b2ae16f709c0193e1b4340bde26ef3e2687d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/b04578b74f2d3755548fe9e829e3b2a6c6f966a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/bbc68ba258a4eb0a2ca3b3a105550801aa8b00b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/de6cc6ec7932bc530f2bb92005dac9123d50659c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e1c9f9446d3eaae323f1689f9e5de3b1ad6e47ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f487b5788f15c6c32a219ed1480d25c93fc18d30","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98079","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:37.307","lastModified":"2026-10-21T13:21:21.620","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zstd: fix lost wakeup when waiting for a workspace\n\nA writer can sleep forever in zstd_get_workspace() even though a workspace\nis free.  When zstd_alloc_workspace() fails, the task is queued on\nzwsm->wait and schedules unconditionally, never re-testing the pool.\nzstd_put_workspace() publishes the workspace and then calls cond_wake_up(),\nwhich only wakes when a sleeper is already visible, so a workspace returned\nbetween the failed allocation and prepare_to_wait() wakes nobody.  The\nwindow is wide: zstd_alloc_workspace() goes through kvmalloc() and may\nenter reclaim.\n\nOnly a max level workspace triggers the wakeup and one is deliberately kept\nallocated as the fallback every waiter waits for, so once its wakeup is\nlost the writer stays in TASK_UNINTERRUPTIBLE until some other task happens\nto return one.  Re-check the pool after prepare_to_wait() has published the\nwaiter, and use the workspace if one turned up."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/zstd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3f93aef535c8ea03e40cd8acf0753b3e6ed33e96","lessThan":"14d982762945d9945c60bbd48b77df194dd8e28d","versionType":"git","status":"affected"},{"version":"3f93aef535c8ea03e40cd8acf0753b3e6ed33e96","lessThan":"844603cf842ee67640d33f350e3fa60f3de7fad3","versionType":"git","status":"affected"},{"version":"3f93aef535c8ea03e40cd8acf0753b3e6ed33e96","lessThan":"d8f57049521948df5f50797141472fbbed3b0723","versionType":"git","status":"affected"},{"version":"3f93aef535c8ea03e40cd8acf0753b3e6ed33e96","lessThan":"0de9f31d447ae71ab08c7850a321682f8d2907c3","versionType":"git","status":"affected"},{"version":"3f93aef535c8ea03e40cd8acf0753b3e6ed33e96","lessThan":"2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/zstd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.1","status":"affected"},{"version":"0","lessThan":"5.1","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0de9f31d447ae71ab08c7850a321682f8d2907c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/14d982762945d9945c60bbd48b77df194dd8e28d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/844603cf842ee67640d33f350e3fa60f3de7fad3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d8f57049521948df5f50797141472fbbed3b0723","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98080","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:37.417","lastModified":"2026-10-19T10:18:03.930","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not force reloc root creation during qgroup_account_snapshot()\n\n[BUG]\nWhen running btrfs/252 with quota enabled through MKFS_OPTIONS=\"-O quota\",\nit has a high chance to trigger the following kernel warning and flips\nthe fs RO:\n\n  BTRFS info (device dm-2): relocating block group 30408704 flags metadata|dup\n  ------------[ cut here ]------------\n  WARNING: fs/btrfs/extent-tree.c:879 at lookup_inline_extent_backref+0x74b/0x960 [btrfs], CPU#4: btrfs/2173\n  CPU: 4 UID: 0 PID: 2173 Comm: btrfs Not tainted 7.2.0-rc6-custom+ #457 PREEMPT(full)  3adc6528fb66f7a55fe1095385818e742f200aab\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\n  RIP: 0010:lookup_inline_extent_backref+0x74b/0x960 [btrfs]\n  Call Trace:\n   <TASK>\n   insert_inline_extent_backref+0x7c/0x160 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   __btrfs_inc_extent_ref+0xa9/0x270 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   __btrfs_run_delayed_refs+0x4af/0x11c0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_run_delayed_refs+0x9d/0xf0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   create_pending_snapshot+0x39d/0xf00 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   create_pending_snapshots+0x9b/0xc0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_commit_transaction+0x280/0xeb0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   prepare_to_relocate+0x147/0x200 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   relocate_block_group+0x6b/0x5e0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_relocate_block_group+0x92c/0x2380 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_relocate_chunk+0x3f/0x1a0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_balance+0xa2c/0x19c0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_ioctl+0x2839/0x2d30 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   __x64_sys_ioctl+0x416/0x9a0\n   do_syscall_64+0xe1/0x790\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   </TASK>\n  ---[ end trace 0000000000000000 ]---\n  BTRFS info (device dm-2): leaf 4593991680 gen 233 total ptrs 175 free space 5953 owner 2\n  BTRFS info (device dm-2): refs 3 lock_owner 2173 current 2173\n  \titem 0 key (166772736 METADATA_ITEM 1) itemoff 16250 itemsize 33\n  \t\textent refs 1 gen 222 flags 2\n  \t\tref#0: tree block backref root 266\n         [ Skip the tree dump ]\n  \titem 174 key (263225344 METADATA_ITEM 0) itemoff 10328 itemsize 33\n  \t\textent refs 1 gen 162 flags 258\n  \t\tref#0: tree block backref root 267\n  BTRFS error (device dm-2): extent item not found for insert, bytenr 179847168 num_bytes 16384 parent 4594335744 root_objectid 273 owner 0 offset 0\n  BTRFS error (device dm-2): failed to run delayed ref for logical 179847168 num_bytes 16384 type 182 action 1 ref_mod 1: -117\n\n[CAUSE]\nThe above error is showing that there is a tree reference to a metadata\nextent that is no longer there.\n\nWith \"ref_verify\" mount option (requires CONFIG_BTRFS_DEBUG), there is\nsome extra debug output:\n\n  BTRFS error (device dm-2): dumping block entry [180961280 16384], num_refs 0, metadata 1, from disk 0\n  BTRFS error (device dm-2):   root entry 256, num_refs 18446744073709551615\n  BTRFS error (device dm-2):   root entry 273, num_refs 18446744073709551615\n  BTRFS error (device dm-2):   Ref action 3, root 273, ref_root 273, parent 0, owner 0, offset 0, num_refs 1\n     btrfs_force_cow_block+0x129/0x7d0 [btrfs]\n     btrfs_cow_block+0x10a/0x250 [btrfs]\n     btrfs_search_slot+0x5eb/0xf40 [btrfs]\n     btrfs_insert_empty_items+0x3a/0x70 [btrfs]\n     insert_with_overflow+0x53/0x130 [btrfs]\n     btrfs_insert_dir_item+0x125/0x290 [btrfs]\n     btrfs_add_link+0xaa/0x410 [btrfs]\n     btrfs_rename+0x5ea/0xcd0 [btrfs]\n     btrfs_rename2+0x28/0x60 [btrfs]\n     vfs_rename+0x5b2/0xe10\n     filename_renameat2+0x244/0x430\n     __x64_sys_rename+0x48/0x70\n     do_syscall_64+0xe1/0x790\n     entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \n---truncated---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/transaction.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4d31778aa2fa342f5f92ca4025b293a1729161d1","lessThan":"d0284d974be46a0a06068f930c84039d540ae8ed","versionType":"git","status":"affected"},{"version":"4d31778aa2fa342f5f92ca4025b293a1729161d1","lessThan":"21bd77c132f18dc21c6fcdf417310d1adcf7448b","versionType":"git","status":"affected"},{"version":"4d31778aa2fa342f5f92ca4025b293a1729161d1","lessThan":"7ce02d52548b672795511c2cac8da6ec79ac8877","versionType":"git","status":"affected"},{"version":"4d31778aa2fa342f5f92ca4025b293a1729161d1","lessThan":"7caaae233a55e167063f4cfa3385b1a04c8bbecb","versionType":"git","status":"affected"},{"version":"4d31778aa2fa342f5f92ca4025b293a1729161d1","lessThan":"c4c78768d1a8ceb713693cc5524acbe984c31f3c","versionType":"git","status":"affected"},{"version":"4d31778aa2fa342f5f92ca4025b293a1729161d1","lessThan":"203cbfb4fba590bd9b08bd36fa6d05b5d28923bf","versionType":"git","status":"affected"},{"version":"4d31778aa2fa342f5f92ca4025b293a1729161d1","lessThan":"b5d5ab5a715001dd937c920ef8c5688fd4999ba1","versionType":"git","status":"affected"},{"version":"4d31778aa2fa342f5f92ca4025b293a1729161d1","lessThan":"cacf35832292997018837e484283f95a9301ebf5","versionType":"git","status":"affected"},{"version":"204bfcda824428b3a298eae8e87875bbd435a3c1","versionType":"git","status":"affected"},{"version":"1f586802bb18892d2a6eb7d31d7fed78946d21a1","versionType":"git","status":"affected"},{"version":"4.14.45","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.16.13","lessThan":"4.17","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/transaction.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-672"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.45","versionEndExcluding":"4.15","matchCriteriaId":"6D700D41-4E8D-4E37-8603-F71095BDF7CF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16.13","versionEndExcluding":"5.10.271","matchCriteriaId":"030C9B37-5360-4849-87C4-2E18CCB2174E"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.222","matchCriteriaId":"A5EFABC8-89EB-4EE7-9EE1-A9A30E730AFC"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.1.189","matchCriteriaId":"8D92935F-58C8-4A77-A806-0274F6C958F0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.158","matchCriteriaId":"575D98F4-AE0C-4D1F-91BC-CD1C75F0FED0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/203cbfb4fba590bd9b08bd36fa6d05b5d28923bf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/21bd77c132f18dc21c6fcdf417310d1adcf7448b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/7caaae233a55e167063f4cfa3385b1a04c8bbecb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/7ce02d52548b672795511c2cac8da6ec79ac8877","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/b5d5ab5a715001dd937c920ef8c5688fd4999ba1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/c4c78768d1a8ceb713693cc5524acbe984c31f3c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/cacf35832292997018837e484283f95a9301ebf5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d0284d974be46a0a06068f930c84039d540ae8ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98081","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:37.573","lastModified":"2026-10-21T13:21:21.793","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zoned: finish active block group cleanup if call_zone_finish() fails\n\ndo_zone_finish() clears BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE before finishing\nthe zones. If call_zone_finish() then fails it returned early, leaving the\nnow inactive block group on fs_info->zone_active_bgs, leaking its\nreference, the BTRFS_FS_NEED_ZONE_FINISH waiters are never woken, and as\nits alloc_offset equals the zone capacity btrfs_zone_finish_one_bg() keeps\nselecting it, spinning btrfs_zoned_activate_one_bg().\n\nFall through to the cleanup on failure too and return the error, but keep\nthe block group read-only as its zones are left inconsistent."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/zoned.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d70cbdda75da3f258118a558c087157e073229fb","lessThan":"433d52b196a689b18dcfadc7cf6c784f0e5cc7c9","versionType":"git","status":"affected"},{"version":"d70cbdda75da3f258118a558c087157e073229fb","lessThan":"36b9cdab44848f25879ca625275c92b007f84653","versionType":"git","status":"affected"},{"version":"d70cbdda75da3f258118a558c087157e073229fb","lessThan":"40370f02a1ca3760f8925ffcbe76eb4d91ea758d","versionType":"git","status":"affected"},{"version":"d70cbdda75da3f258118a558c087157e073229fb","lessThan":"e1b168a53174b385e3548bfbd079513b22ac240c","versionType":"git","status":"affected"},{"version":"d70cbdda75da3f258118a558c087157e073229fb","lessThan":"a18a6b93a2843b9d103d3456bbd4b3f90282a379","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/zoned.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/36b9cdab44848f25879ca625275c92b007f84653","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/40370f02a1ca3760f8925ffcbe76eb4d91ea758d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/433d52b196a689b18dcfadc7cf6c784f0e5cc7c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a18a6b93a2843b9d103d3456bbd4b3f90282a379","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e1b168a53174b385e3548bfbd079513b22ac240c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98082","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:37.730","lastModified":"2026-10-19T10:18:04.247","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix the possible bioc_list memory leak during error\n\nThere are two possible ways to leak bioc memory on\nbtrfs_ordered_extent::bioc_list:\n\n- An error occurred for btrfs_insert_one_raid_extent()\n  Then the function btrfs_insert_raid_extent() immediately return\n  without freeing any bioc in the bioc_list.\n\n- An ordered extent hit an IO error\n  In that case the ordered extent will have BTRFS_ORDERED_IOERR set, and\n  skip the call on btrfs_insert_raid_extent() completely.\n\nFix the problem by:\n\n- Introduce a new helper, btrfs_cleanup_ordered_bioc_list()\n  Which will remove all bioc from the bioc_list, and release the bioc.\n\n- Call the above helper for btrfs_insert_raid_extent()\n  So that the cleanup helper is always called no matter what.\n\n- Call the above helper for btrfs_finish_one_ordered()\n  This is called just before the final release on the ordered extent.\n\nThis was reported by Sashiko when reviewing another patch."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/inode.c","fs/btrfs/raid-stripe-tree.c","fs/btrfs/raid-stripe-tree.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ab69bf6f8970c09d3735c25094e9471d54365282","lessThan":"d043c43d2b4ebcd75ee7f907948ef2847306d6b2","versionType":"git","status":"affected"},{"version":"02c372e1f016e5113217597ab37b399c4e407477","lessThan":"83f0c973cffb184d019390ffdb5d31de5c85bc61","versionType":"git","status":"affected"},{"version":"02c372e1f016e5113217597ab37b399c4e407477","lessThan":"1b4d4e890c2c85d0f6365b5a08c48b4bbf85deb0","versionType":"git","status":"affected"},{"version":"02c372e1f016e5113217597ab37b399c4e407477","lessThan":"bb4da45766d16503821f167054db76b735d89e94","versionType":"git","status":"affected"},{"version":"02c372e1f016e5113217597ab37b399c4e407477","lessThan":"afbe73778338e6d1ac8c4486fbdf33f0cc1f2624","versionType":"git","status":"affected"},{"version":"6.6.130","lessThan":"6.6.158","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/inode.c","fs/btrfs/raid-stripe-tree.c","fs/btrfs/raid-stripe-tree.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-401"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.130","versionEndExcluding":"6.6.158","matchCriteriaId":"FDC8EFE7-C481-4EDA-B6EA-AD5862994847"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1b4d4e890c2c85d0f6365b5a08c48b4bbf85deb0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/83f0c973cffb184d019390ffdb5d31de5c85bc61","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/afbe73778338e6d1ac8c4486fbdf33f0cc1f2624","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/bb4da45766d16503821f167054db76b735d89e94","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d043c43d2b4ebcd75ee7f907948ef2847306d6b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98083","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:37.860","lastModified":"2026-10-19T10:18:04.367","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix transaction use-after-free in raid stripe insertion\n\nIf allocation of a RAID stripe extent fails,\nbtrfs_insert_one_raid_extent() aborts and ends the transaction before\nreturning -ENOMEM.\n\nbtrfs_finish_one_ordered(), the production caller through\nbtrfs_insert_raid_extent(), still owns the transaction handle. It handles\nthe error by aborting the transaction and then reaches the common exit\npath, which ends the transaction again.\n\nThe premature end can free the handle and drop its transaction reference.\nTransaction cleanup can then free the transaction before the caller's\nsecond abort accesses the handle and transaction, resulting in\nuse-after-free.\n\nKeep the abort at the failure site, but let the caller's common exit path\nend the transaction once, after it has finished using both objects."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/raid-stripe-tree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ab69bf6f8970c09d3735c25094e9471d54365282","lessThan":"089d9c45ea49ffffe55a8fe08d0ce2536626e90a","versionType":"git","status":"affected"},{"version":"02c372e1f016e5113217597ab37b399c4e407477","lessThan":"b185bdf30313e213fa1c887fe22fc3d513c061d9","versionType":"git","status":"affected"},{"version":"02c372e1f016e5113217597ab37b399c4e407477","lessThan":"2fbfd02bdfe12b20bd3cc7a3190fb32e3f7072f5","versionType":"git","status":"affected"},{"version":"02c372e1f016e5113217597ab37b399c4e407477","lessThan":"b7b94923b3b5774d85a2a7c8d6eb9e3e0ef66685","versionType":"git","status":"affected"},{"version":"02c372e1f016e5113217597ab37b399c4e407477","lessThan":"a8813a923f9e43f788b357fb55c35f7f6ed6f98c","versionType":"git","status":"affected"},{"version":"6.6.130","lessThan":"6.6.158","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/raid-stripe-tree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.130","versionEndExcluding":"6.6.158","matchCriteriaId":"FDC8EFE7-C481-4EDA-B6EA-AD5862994847"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/089d9c45ea49ffffe55a8fe08d0ce2536626e90a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/2fbfd02bdfe12b20bd3cc7a3190fb32e3f7072f5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/a8813a923f9e43f788b357fb55c35f7f6ed6f98c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/b185bdf30313e213fa1c887fe22fc3d513c061d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/b7b94923b3b5774d85a2a7c8d6eb9e3e0ef66685","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98084","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:37.980","lastModified":"2026-10-21T13:21:21.960","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: backtracking shouldn't clear outer frame R1-R5 for callbacks\n\nWhen processing calls to bpf_loop() verifier marks R1 (and R4) as\nprecise. R1 tracks loop iterations number and because of the\n'callback_depth < R1' mechanics in check_helper_call() must be marked\nprecise. However, precision propagation for R1 was broken,\nwhen bpf_loop() call was verified on a second iteration.\n\nConsider the following verification trace:\n- main: bpf_loop(nr_loops, callback ...)\n- callback: BPF_EXIT\n- main: bpf_loop(nr_loops, callback ...)\n- ...\n\nWhile the first visit of the call to bpf_loop() propagated R1\nprecision as expected, the second call to mark_chain_precision() in\nthe check_helper_call() set R1, but it was immediately reset when\nbacktrack_insn() processed preceding BPF_EXIT in the loop deleted in\nthis patch.\n\nBecause of that, the second visit of the call to bpf_loop() injected\ncheckpoint with R1 not marked as precise. Which could trick the\nverifier into accepting unsafe programs. See the next patch for an\nexample of such program.\n\nCommit is structured in a way to minimize conflicts when\n'bpf' would be eventually merged with 'bpf-next'."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/backtrack.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b43550d7d58e7ae6618aaab18c1e912fa4d6e3dd","lessThan":"1ac58dab0a83d2c64e3b807a3a0b399f17a74110","versionType":"git","status":"affected"},{"version":"ab5cfac139ab8576fb54630d4cca23c3e690ee90","lessThan":"cdc93c6370f792d0649df2a145ac0cdcd430e411","versionType":"git","status":"affected"},{"version":"ab5cfac139ab8576fb54630d4cca23c3e690ee90","lessThan":"3a39bc9707fbd1bef4df7318a9d02222741dda5b","versionType":"git","status":"affected"},{"version":"ab5cfac139ab8576fb54630d4cca23c3e690ee90","lessThan":"f83890dfed9efc5e19df1dbc1ad707a142936923","versionType":"git","status":"affected"},{"version":"ab5cfac139ab8576fb54630d4cca23c3e690ee90","lessThan":"e3e4f66cc4b72333d0886ae2673c360248987889","versionType":"git","status":"affected"},{"version":"6.6.15","lessThan":"6.6.160","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/backtrack.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1ac58dab0a83d2c64e3b807a3a0b399f17a74110","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3a39bc9707fbd1bef4df7318a9d02222741dda5b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cdc93c6370f792d0649df2a145ac0cdcd430e411","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3e4f66cc4b72333d0886ae2673c360248987889","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f83890dfed9efc5e19df1dbc1ad707a142936923","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98085","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:38.087","lastModified":"2026-10-21T13:21:22.137","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge\n\nNicholas Carlini reported a bug in precision backtracking mechanism\nfor BPF_LD | BPF_{IND,ABS} instructions. These instructions are\nmodelled as two branches:\n- fallthrough;\n- implicit exit from current subprogram.\n\nThe implicit exit case was not handled by the backtrack_insn()\nfunction. When backtracking such a path backtrack_insn() did not\ncall bt_subprog_enter(), which meant that backtracking continued\nmanipulating precision marks in a caller frame, while looking at\ninstructions in a callee frame.\n\nThis lead to segmentation faults during verification (see the\nselftest), or unsound state pruning."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/backtrack.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"37ad2bb11e9de92cb7b94548705eeedd87f7d392","lessThan":"19cca7c36055906b3cff3e297618ee8a50cde25d","versionType":"git","status":"affected"},{"version":"8674e2db06cff6b50f2216eed9a761d15425bb34","lessThan":"12c064bcfa56e3631be9f5336ee113b7f849959a","versionType":"git","status":"affected"},{"version":"ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337","lessThan":"a0cd9e22f8faed30a8da8be357c51bd8b3074ee9","versionType":"git","status":"affected"},{"version":"ee861486e377edc55361c08dcbceab3f6b6577bd","lessThan":"671b7b9a660ef15b25faa3df161205b9dc8d1eb2","versionType":"git","status":"affected"},{"version":"ee861486e377edc55361c08dcbceab3f6b6577bd","lessThan":"387b1baefbb776e3f48dc2261e77a49213f470f7","versionType":"git","status":"affected"},{"version":"928d354ae3557e8f755a227e67be88034eb3cd7f","versionType":"git","status":"affected"},{"version":"8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe","versionType":"git","status":"affected"},{"version":"de1055e7f9e67af32b1f3376066272b04e5223c0","versionType":"git","status":"affected"},{"version":"d846d83bdacbd8f14fc45c63b8c1d22608452e1c","versionType":"git","status":"affected"},{"version":"6.6.148","lessThan":"6.6.160","versionType":"semver","status":"affected"},{"version":"6.12.101","lessThan":"6.12.114","versionType":"semver","status":"affected"},{"version":"6.18.42","lessThan":"6.18.57","versionType":"semver","status":"affected"},{"version":"5.10.265","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.15.216","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.183","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"7.0.10","lessThan":"7.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/backtrack.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/12c064bcfa56e3631be9f5336ee113b7f849959a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/19cca7c36055906b3cff3e297618ee8a50cde25d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/387b1baefbb776e3f48dc2261e77a49213f470f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/671b7b9a660ef15b25faa3df161205b9dc8d1eb2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0cd9e22f8faed30a8da8be357c51bd8b3074ee9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98086","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:38.200","lastModified":"2026-10-19T10:18:04.883","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ump: do not touch legacy_rmidi before it exists\n\nsnd_ump_parse_endpoint() sets ump->parsed on every exit, including\nerror, before the caller attaches the legacy rawmidi device.\nump_handle_ep_name_msg() then treats parsed as \"legacy_rmidi is live\"\nand calls ump_legacy_set_rawmidi_name(), which snprintf()s into\nump->legacy_rmidi->name. If a UMP packet arrives in that window\n(IRQ path from snd_ump_receive), legacy_rmidi is still NULL\n(KASAN null-ptr-deref in snprintf).\n\nGuard the legacy helpers. parsed only means endpoint info was\nparsed, not that legacy_rmidi exists."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/core/ump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"37e0e14128e0685267dc5c037bf655421a6ce2ea","lessThan":"d6f9af093dc91dac8848a01e417b8109c651c0b2","versionType":"git","status":"affected"},{"version":"37e0e14128e0685267dc5c037bf655421a6ce2ea","lessThan":"1c8e01792adf91879322f1ad752f1814de8b7e7d","versionType":"git","status":"affected"},{"version":"37e0e14128e0685267dc5c037bf655421a6ce2ea","lessThan":"228075f31b141395233218712242913125ace4e0","versionType":"git","status":"affected"},{"version":"37e0e14128e0685267dc5c037bf655421a6ce2ea","lessThan":"a4cef20cd473e0640fefd38094d4baac0ec76ae3","versionType":"git","status":"affected"},{"version":"37e0e14128e0685267dc5c037bf655421a6ce2ea","lessThan":"adeee7187694719890aaffdc14b7e89cfd736f1d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/core/ump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1c8e01792adf91879322f1ad752f1814de8b7e7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/228075f31b141395233218712242913125ace4e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4cef20cd473e0640fefd38094d4baac0ec76ae3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/adeee7187694719890aaffdc14b7e89cfd736f1d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6f9af093dc91dac8848a01e417b8109c651c0b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98087","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:38.343","lastModified":"2026-10-19T10:18:05.083","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched/rt,dl: Skip migrate-disabled tasks when picking a push candidate\n\nA migrate_disable()'d RT task cannot be moved to another CPU, but the\nscheduler still keeps such a task on that CPU's pushable list\n(rq->rt.pushable_tasks) and still marks the runqueue RT-overloaded\n(rq->rt.overloaded = 1). So the RT balancer keeps treating this CPU as\nhaving a task to move away, and keeps trying to move the task, but the\npush can never succeed. When the head is pinned, push_rt_task() does not\ngive up either. It falls back to pushing rq->curr instead, using the\nper-CPU stopper, as added by commit a7c81556ec4d (\"sched: Fix\nmigrate_disable() vs rt/dl balancing\").\n\nThe CPU spends tens of milliseconds in this retry loop. The core is\nisolated for real-time work, but during the loop nearly half of its time\nis consumed by pushes that cannot succeed.\n\nAn ftrace capture of the affected CPU, with sched_switch enabled and\ncommit 94894c9c477e (\"sched/rt: Skip currently executing CPU in\nrto_next_cpu()\") applied, shows where the CPU time went. Two SCHED_FIFO\ntasks at equal priority shared the CPU, taskA migrate_disable()'d and\nqueued, taskB as rq->curr. In one 89 ms window, taskB got only 52 ms of\nCPU. The other 37 ms went to the stopper thread.\n\nThe scheduler kept trying to push taskA, the pinned head of the pushable\nlist, fell back to pushing taskB instead, and woke the stopper 5204\ntimes. Every one of those pushes failed and no task was moved. taskA\nstayed runnable and queued the whole time, and never ran.\n\nPushing taskB fails on a re-check. find_lock_lowest_rq() drops the rq\nlock to take the target rq lock, then checks again with\n\"task != pick_next_pushable_task(rq)\".\n\nThe task being pushed is taskB, but the pick returns taskA, the head of\nthe pushable list. taskB is rq->curr, and set_next_task_rt() removes the\nrunning task from that list, so taskB can never be the head. The check\nexpects a candidate taken from the pushable list, but the fallback\npushes rq->curr, which is never on that list. So the check fails every\ntime.\n\n   .--> push-IPI arrives\n   |          |\n   |          v\n   |     pushable head = taskA   ->  pinned, cannot be pushed\n   |          |\n   |          v\n   |     so push taskB instead   ->  wake migration/N, a stop-class\n   |          |                      thread, so it preempts taskB\n   |          v\n   |     re-check compares taskB against the pushable head,\n   |     which is still taskA                        ->  give up\n   |          |\n   |          v\n   |     nothing moved, taskA still queued, rq still overloaded\n   |          |\n   '----------'\n         repeats every ~17 us, 5204 times, for 89 ms\n\n   The loop cannot stop itself. Every round leaves the runqueue\n   exactly as it was, so the next push-IPI does the same thing. In\n   the capture it ended only when taskB went to sleep on its own.\n   taskA was then picked locally and left the pushable list.\n\n   CPU time per task in the window, from sched_switch:\n\n     taskB         51.95 ms   real work\n     migration/N   37.18 ms   nothing moved\n     taskA          0.00 ms   queued the whole time, never picked\n     idle           0.01 ms\n\n   Counts over the same window:\n\n      7667  push-IPIs handled on this CPU\n     17481  pick_next_pushable_task() returned taskA, still pinned\n      5204  find_lock_lowest_rq() gave up on the re-check\n         1  push that actually completed\n         0  migrations of taskA\n\n   The CPU times and the window length come from the standard\n   sched_switch tracepoint. The counts needed tracepoints added inside\n   the RT balancer for this investigation.\n\nThe self-IPI path is closed by the rto_next_cpu() fix above, and that\npart works. But the runqueue is still marked overloaded, because the\npinned task is still advertised as pushable. Other CPUs now send the\npush-IPIs during their own RT balancing, and the same loop runs again.\nClosing the self-IPI path did not stop a pinn\n---truncated---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/sched/deadline.c","kernel/sched/rt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a7c81556ec4d341dfdbf2cc478ead89d73e474a7","lessThan":"755476d7ba92a1f3fe2a376c515d710bc6baebc3","versionType":"git","status":"affected"},{"version":"a7c81556ec4d341dfdbf2cc478ead89d73e474a7","lessThan":"b0c6f947057751ab4d30ccf8095cd19804fb97fa","versionType":"git","status":"affected"},{"version":"a7c81556ec4d341dfdbf2cc478ead89d73e474a7","lessThan":"dae5c0292080dd7b9c7d784268dcf443f1f3d15e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/sched/deadline.c","kernel/sched/rt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/755476d7ba92a1f3fe2a376c515d710bc6baebc3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0c6f947057751ab4d30ccf8095cd19804fb97fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dae5c0292080dd7b9c7d784268dcf443f1f3d15e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98088","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:38.480","lastModified":"2026-10-19T10:18:05.263","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()\n\ndev_to_node() can return NUMA_NO_NODE (-1) on systems without NUMA\ntopology information for the PCI device, such as single-socket boards\nthat don't expose device-to-node affinity. Passing -1 directly into\ncpumask_of_node() indexes node_to_cpumask_map[-1], an out-of-bounds\narray read caught by UBSAN:\n\n  UBSAN: array-index-out-of-bounds in arch/x86/include/asm/topology.h:72:28\n  index -1 is out of range for type 'cpumask *[1024]'\n\nFall back to cpu_online_mask when no NUMA node is available, rather than\nassuming dev_to_node() always returns a valid node index."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/mpt3sas/mpt3sas_base.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"728bbc6cbff70051813730fb7977f5d99d867e12","lessThan":"f531758ef21ba9a7716148cc290e8d9a110f20d9","versionType":"git","status":"affected"},{"version":"728bbc6cbff70051813730fb7977f5d99d867e12","lessThan":"06a994ad7bbd13714cd45df582389f751531e60c","versionType":"git","status":"affected"},{"version":"728bbc6cbff70051813730fb7977f5d99d867e12","lessThan":"7bcce856c79c1799351e170aec83e018ccf3d044","versionType":"git","status":"affected"},{"version":"728bbc6cbff70051813730fb7977f5d99d867e12","lessThan":"0a5f7cdb0cb911584720591069065f09c59ec4fc","versionType":"git","status":"affected"},{"version":"728bbc6cbff70051813730fb7977f5d99d867e12","lessThan":"7b23144c3ff6e46d7d4a464b02f8944265684e39","versionType":"git","status":"affected"},{"version":"728bbc6cbff70051813730fb7977f5d99d867e12","lessThan":"45504e621b7e884abe59f201e093a3eac7fca7fe","versionType":"git","status":"affected"},{"version":"728bbc6cbff70051813730fb7977f5d99d867e12","lessThan":"e0d26fe176a8db6ccad4ab38c5bab29391c1946b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/mpt3sas/mpt3sas_base.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/06a994ad7bbd13714cd45df582389f751531e60c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0a5f7cdb0cb911584720591069065f09c59ec4fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/45504e621b7e884abe59f201e093a3eac7fca7fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7b23144c3ff6e46d7d4a464b02f8944265684e39","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7bcce856c79c1799351e170aec83e018ccf3d044","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e0d26fe176a8db6ccad4ab38c5bab29391c1946b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f531758ef21ba9a7716148cc290e8d9a110f20d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98089","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:38.590","lastModified":"2026-10-19T10:18:05.423","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: fix uninitialized transport header access in alb_determine_nd()\n\nalb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers.\nHowever, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets\nor forwarded packets), skb->transport_header is not guaranteed to be\ninitialized. While pskb_network_may_pull() ensures the packet data is\nlinear starting from the network header, it does not set or adjust the\ntransport header offset.\n\nDereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.\n\nFetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(),\nand reload ipv6hdr in case pskb_may_pull() reallocated skb->head.\nAlso remove the unused bond argument from alb_determine_nd()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/bonding/bond_alb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","lessThan":"862c8eb6947689c44fe11353755576a3672563a5","versionType":"git","status":"affected"},{"version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","lessThan":"7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99","versionType":"git","status":"affected"},{"version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","lessThan":"e39cf90bd856443542b97933289749fca07476bf","versionType":"git","status":"affected"},{"version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","lessThan":"27314f96d29b54e815e7a9b84c3273f1895e68e2","versionType":"git","status":"affected"},{"version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","lessThan":"3b178894931a268c09126a5b53630f343e10e296","versionType":"git","status":"affected"},{"version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","lessThan":"70f3995830d3f1e79faa14eb0605914f778feca9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/bonding/bond_alb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/27314f96d29b54e815e7a9b84c3273f1895e68e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b178894931a268c09126a5b53630f343e10e296","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/70f3995830d3f1e79faa14eb0605914f778feca9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/862c8eb6947689c44fe11353755576a3672563a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e39cf90bd856443542b97933289749fca07476bf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98090","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:38.697","lastModified":"2026-10-23T19:00:22.020","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: restore active device pointers after failed sprout\n\nbtrfs_init_new_device() switches latest_dev and possibly s_bdev from the\nseed device to the new sprout device before creating the first writable\nchunks.\n\nIf chunk creation or the subsequent sprout setup fails, the error path\nreleases the new device without switching those pointers back.\nbtrfs_show_devname() can then dereference the freed latest_dev and crash.\n\nRestore the active device pointers to the latest seed device before\nremoving and releasing the failed sprout device."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/volumes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a6e7e218a4d6488d56727a7d9aee1b7e78c0c485","lessThan":"46863a9f93186e620c70584f91c8d5d95da83eff","versionType":"git","status":"affected"},{"version":"b7cb29e666fe79dda5dbe5f57fb7c92413bf161c","lessThan":"49179f13c04735c55fd0f43b03696c015b067137","versionType":"git","status":"affected"},{"version":"b7cb29e666fe79dda5dbe5f57fb7c92413bf161c","lessThan":"0a0ee38ad6324ac1603079bb785f784191576bd5","versionType":"git","status":"affected"},{"version":"b7cb29e666fe79dda5dbe5f57fb7c92413bf161c","lessThan":"2ee5c4bc11007c51f63f0c1be5d3f07f2b404ff7","versionType":"git","status":"affected"},{"version":"b7cb29e666fe79dda5dbe5f57fb7c92413bf161c","lessThan":"e127ac29a52134d0f4cba39d38e4b375deb3d1aa","versionType":"git","status":"affected"},{"version":"b7cb29e666fe79dda5dbe5f57fb7c92413bf161c","lessThan":"b79b4b29003690acfade8241998fc0104ef9c84c","versionType":"git","status":"affected"},{"version":"b7cb29e666fe79dda5dbe5f57fb7c92413bf161c","lessThan":"e0b54613aabeb8e9da597f23b90c6a03d0981986","versionType":"git","status":"affected"},{"version":"5.15.11","lessThan":"5.15.222","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/volumes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"5.15.222","matchCriteriaId":"9B5FB2D7-5BE0-4BD3-B914-D8083487AB9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.189","matchCriteriaId":"FE14E0F2-AE30-4319-B6E7-5D8B82530FD6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.158","matchCriteriaId":"575D98F4-AE0C-4D1F-91BC-CD1C75F0FED0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0a0ee38ad6324ac1603079bb785f784191576bd5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/2ee5c4bc11007c51f63f0c1be5d3f07f2b404ff7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/46863a9f93186e620c70584f91c8d5d95da83eff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/49179f13c04735c55fd0f43b03696c015b067137","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/b79b4b29003690acfade8241998fc0104ef9c84c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e0b54613aabeb8e9da597f23b90c6a03d0981986","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e127ac29a52134d0f4cba39d38e4b375deb3d1aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98091","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:38.807","lastModified":"2026-10-23T18:55:09.060","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: detach failed sprout device from transaction update list\n\nWhen creating the first metadata chunk for a sprout filesystem,\ncreate_chunk() adds the new device to the transaction dev_update_list\nthrough device->post_commit_list.\n\nIf the subsequent system chunk creation fails, btrfs_init_new_device()\naborts the transaction and releases the device while post_commit_list is\nstill linked. This triggers a warning in btrfs_free_device() and leaves\nthe transaction list referencing freed memory.\n\nDetach the device while holding chunk_mutex before releasing it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/volumes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bbbf7243d62d8be73b7ef60721c127b36b2d523e","lessThan":"2a57fb1d5ce8f316b81bbb60e6df245ebc816ffc","versionType":"git","status":"affected"},{"version":"bbbf7243d62d8be73b7ef60721c127b36b2d523e","lessThan":"86eff3052054e8f3b059b2d5845b6dcca021f20c","versionType":"git","status":"affected"},{"version":"bbbf7243d62d8be73b7ef60721c127b36b2d523e","lessThan":"63bfa52eb3289517aa82cb90e1189385873aae21","versionType":"git","status":"affected"},{"version":"bbbf7243d62d8be73b7ef60721c127b36b2d523e","lessThan":"7fe9dfbca43464baa8f050447a4837587b18adec","versionType":"git","status":"affected"},{"version":"bbbf7243d62d8be73b7ef60721c127b36b2d523e","lessThan":"e9e7e37afa85db770e6084360b21a21a8b3a583f","versionType":"git","status":"affected"},{"version":"bbbf7243d62d8be73b7ef60721c127b36b2d523e","lessThan":"8b001df2b37ca022f710f3254fbb0bcd6d9e1bed","versionType":"git","status":"affected"},{"version":"bbbf7243d62d8be73b7ef60721c127b36b2d523e","lessThan":"0ea6814bc0ff7cff443241bd34db9f0f828f3190","versionType":"git","status":"affected"},{"version":"bbbf7243d62d8be73b7ef60721c127b36b2d523e","lessThan":"c93b3c43df561cd9f592cee20ae058b563f9e5b6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/volumes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.2","status":"affected"},{"version":"0","lessThan":"5.2","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"5.10.271","matchCriteriaId":"CD3DFDB6-BA24-469D-AD82-12F150CD2406"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.222","matchCriteriaId":"A5EFABC8-89EB-4EE7-9EE1-A9A30E730AFC"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.189","matchCriteriaId":"FE14E0F2-AE30-4319-B6E7-5D8B82530FD6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.158","matchCriteriaId":"575D98F4-AE0C-4D1F-91BC-CD1C75F0FED0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0ea6814bc0ff7cff443241bd34db9f0f828f3190","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/2a57fb1d5ce8f316b81bbb60e6df245ebc816ffc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/63bfa52eb3289517aa82cb90e1189385873aae21","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/7fe9dfbca43464baa8f050447a4837587b18adec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/86eff3052054e8f3b059b2d5845b6dcca021f20c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/8b001df2b37ca022f710f3254fbb0bcd6d9e1bed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/c93b3c43df561cd9f592cee20ae058b563f9e5b6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e9e7e37afa85db770e6084360b21a21a8b3a583f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98092","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:38.913","lastModified":"2026-10-23T18:51:32.263","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()\n\nacp6x_pdm_dma_close() does not free the runtime->private_data buffer\nallocated in acp6x_pdm_dma_open(). Add the missing kfree."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/soc/amd/yc/acp6x-pdm-dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7610174a5bfe6cf34eda8f972311e629ae6dc2d1","lessThan":"28869353ab83a7fa08fe5fe7b12c84b0257a63b1","versionType":"git","status":"affected"},{"version":"7610174a5bfe6cf34eda8f972311e629ae6dc2d1","lessThan":"d356c188a653d31c20cd69a152b2e2ea9893180a","versionType":"git","status":"affected"},{"version":"7610174a5bfe6cf34eda8f972311e629ae6dc2d1","lessThan":"8069bc3798dd33e8e7e9ad21370ee32dcd69957c","versionType":"git","status":"affected"},{"version":"7610174a5bfe6cf34eda8f972311e629ae6dc2d1","lessThan":"ecd88ef5f1d208596592cfa6695ab9e240ac6a72","versionType":"git","status":"affected"},{"version":"7610174a5bfe6cf34eda8f972311e629ae6dc2d1","lessThan":"ac961c34cf39f66296caf8294fa5baaee4124266","versionType":"git","status":"affected"},{"version":"7610174a5bfe6cf34eda8f972311e629ae6dc2d1","lessThan":"1b67e0d3b9691d7b6b74e18960ddd2be24f9dc9d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/soc/amd/yc/acp6x-pdm-dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-401"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.189","matchCriteriaId":"FE14E0F2-AE30-4319-B6E7-5D8B82530FD6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.158","matchCriteriaId":"575D98F4-AE0C-4D1F-91BC-CD1C75F0FED0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*","matchCriteriaId":"14FD7B9A-4946-4511-8E63-6E13870CD4A8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1b67e0d3b9691d7b6b74e18960ddd2be24f9dc9d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/28869353ab83a7fa08fe5fe7b12c84b0257a63b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/8069bc3798dd33e8e7e9ad21370ee32dcd69957c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/ac961c34cf39f66296caf8294fa5baaee4124266","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d356c188a653d31c20cd69a152b2e2ea9893180a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/ecd88ef5f1d208596592cfa6695ab9e240ac6a72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98093","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:39.023","lastModified":"2026-10-23T18:48:31.317","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: fsl_micfil: balance mclk enable/disable\n\nhw_params() enables mclk unconditionally and hw_free() disables it\nunconditionally, but the PCM core does not guarantee 1:1 pairing:\nhw_free() can run without hw_params(), and hw_params() can be called\nmultiple times from the SETUP state. This triggers an \"already\ndisabled\" WARN() in the first case and leaks an enable reference in\nthe second, leaving the clock ungateable.\n\nGuard both sides with the existing mclk_flag, as fsl_sai.c does with\nmclk_streams."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/soc/fsl/fsl_micfil.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b47024dc624bcffb89d238f4a5b490363cea2a1e","lessThan":"470db2026a435b79f7ecb4d65523ea16a99d55d8","versionType":"git","status":"affected"},{"version":"b47024dc624bcffb89d238f4a5b490363cea2a1e","lessThan":"fa1bbe3534499dd89d3b0b941d6dd4ddb70c31b5","versionType":"git","status":"affected"},{"version":"b47024dc624bcffb89d238f4a5b490363cea2a1e","lessThan":"d3dbccfe6afa7b9a6a7ed65cfaa76a47fa050a56","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/soc/fsl/fsl_micfil.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-404"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*","matchCriteriaId":"14FD7B9A-4946-4511-8E63-6E13870CD4A8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/470db2026a435b79f7ecb4d65523ea16a99d55d8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d3dbccfe6afa7b9a6a7ed65cfaa76a47fa050a56","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/fa1bbe3534499dd89d3b0b941d6dd4ddb70c31b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98094","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:39.133","lastModified":"2026-10-23T18:55:31.727","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: fbtft: make dirty_lock IRQ-safe\n\nfbtft_mkdirty() can be reached from the fbcon rendering path while\nprocessing printk() in hardirq context. Meanwhile, dirty_lock is also\ntaken by fbtft_deferred_io() in workqueue context with local interrupts\nenabled.\n\nLockdep reports a possible IRQ lock inversion involving dirty_lock and\nconsole_owner. A hardirq can interrupt a CPU holding dirty_lock and\nenter the console rendering path, which can attempt to acquire\ndirty_lock again.\n\nThe following lockdep report was observed on an RK3566 system with\nCONFIG_PROVE_LOCKING enabled:\n\n  WARNING: possible irq lock inversion dependency detected\n  swapper/2/0 just changed the state of lock:\n  (console_owner){-...}-{0:0}\n  but this lock took another, HARDIRQ-unsafe lock in the past:\n  (&par->dirty_lock){+.+.}-{2:2}\n\n  CPU0                    CPU1\n  ----                    ----\n  lock(&par->dirty_lock);\n                         local_irq_disable();\n                         lock(console_owner);\n                         lock(&par->dirty_lock);\n  <Interrupt>\n    lock(console_owner);\n\n  *** DEADLOCK ***\n\nUse spin_lock_irqsave() for fbtft_mkdirty() and spin_lock_irq() for\nfbtft_deferred_io(). They only access the dirty line range, so the\nIRQ-off regions remain short."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/fbtft/fbtft-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c296d5f9957c03994a699d6739c27d4581a9f6c7","lessThan":"0843298b159599ee7bc6d14800efdb4bc7349706","versionType":"git","status":"affected"},{"version":"c296d5f9957c03994a699d6739c27d4581a9f6c7","lessThan":"a323066337ed85c38decfc7f6bbf42f27605dff1","versionType":"git","status":"affected"},{"version":"c296d5f9957c03994a699d6739c27d4581a9f6c7","lessThan":"f2451e18826eb6a33ea51419f39bdd2eb99fa1ea","versionType":"git","status":"affected"},{"version":"c296d5f9957c03994a699d6739c27d4581a9f6c7","lessThan":"10cc145b873670438d3b105133dffdae70822db6","versionType":"git","status":"affected"},{"version":"c296d5f9957c03994a699d6739c27d4581a9f6c7","lessThan":"2a609e29efbba79f9abd68c4ec8a2bd7ecf291e7","versionType":"git","status":"affected"},{"version":"c296d5f9957c03994a699d6739c27d4581a9f6c7","lessThan":"f0c869df2c33793c8828acaab3e4a5e0176f9f00","versionType":"git","status":"affected"},{"version":"c296d5f9957c03994a699d6739c27d4581a9f6c7","lessThan":"dcb48fde8003492256dee45815144aa5ed26ce7c","versionType":"git","status":"affected"},{"version":"c296d5f9957c03994a699d6739c27d4581a9f6c7","lessThan":"f576944a59f31bcffff121117ebf452c5dd162b7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/fbtft/fbtft-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.0","status":"affected"},{"version":"0","lessThan":"4.0","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-667"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0","versionEndExcluding":"5.10.271","matchCriteriaId":"3E10172F-2F00-4A66-8B20-96C9F3CB9340"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.222","matchCriteriaId":"A5EFABC8-89EB-4EE7-9EE1-A9A30E730AFC"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.189","matchCriteriaId":"FE14E0F2-AE30-4319-B6E7-5D8B82530FD6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.158","matchCriteriaId":"575D98F4-AE0C-4D1F-91BC-CD1C75F0FED0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0843298b159599ee7bc6d14800efdb4bc7349706","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/10cc145b873670438d3b105133dffdae70822db6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/2a609e29efbba79f9abd68c4ec8a2bd7ecf291e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/a323066337ed85c38decfc7f6bbf42f27605dff1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/dcb48fde8003492256dee45815144aa5ed26ce7c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f0c869df2c33793c8828acaab3e4a5e0176f9f00","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f2451e18826eb6a33ea51419f39bdd2eb99fa1ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f576944a59f31bcffff121117ebf452c5dd162b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98095","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:39.243","lastModified":"2026-10-23T18:15:25.107","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().\n\nsyzbot reported BUG() in sock_sendmsg_nosec(). [0]\n\nThe problem is that tpacket_parse_header() casts user-provided\ntpacket_hdr.tp_len, which is u32, to int.\n\nIf the length is larger than INT_MAX, the following condition\nin tpacket_parse_header() passes,\n\n  if (unlikely(tp_len > size_max))\n\nand any negative value can be returned to the caller, up to\nsock_sendmsg_nosec().\n\nThe repro set tpacket_hdr.tp_len to 0xfffffdef, which is cast\nto -EIOCBQUEUED (-529), triggering BUG() in sock_sendmsg_nosec().\n\n  *(uint64_t*)0x200000000008 = 0xfffffdef;\n  ...\n  syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x200000000000ul, /*count=*/1ul);\n\nLet's define the local tp_len as u32 in tpacket_parse_header().\n\n[0]:\nkernel BUG at net/socket.c:803!\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 0 UID: 0 PID: 5628 Comm: syz-executor176 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026\nRIP: 0010:sock_sendmsg_nosec+0x145/0x180 net/socket.c:803\nCode: 06 67 48 0f b9 3a eb 95 e8 e8 3a 22 f8 48 89 df 4c 89 f6 4c 89 e2 4d 89 fb 2e e8 32 a5 5c 16 e9 51 ff ff ff e8 cc 3a 22 f8 90 <0f> 0b e8 c4 3a 22 f8 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 28\nRSP: 0018:ffffc90003aefb48 EFLAGS: 00010293\nRAX: ffffffff89a578d4 RBX: ffff8880764c67c0 RCX: ffff88807fb23e80\nRDX: 0000000000000000 RSI: 00000000fffffdef RDI: 00000000fffffdef\nRBP: 00000000fffffdef R08: ffffc90003aef747 R09: 1ffff9200075dee8\nR10: dffffc0000000000 R11: fffff5200075dee9 R12: 0000000000000001\nR13: dffffc0000000000 R14: ffffc90003aefbc0 R15: ffffffff8aac4310\nFS:  000055559101b400(0000) GS:ffff888124ce0000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000000210 CR3: 0000000073dca000 CR4: 00000000003526f0\nCall Trace:\n <TASK>\n __sock_sendmsg net/socket.c:815 [inline]\n sock_write_iter+0x2de/0x3e0 net/socket.c:1266\n new_sync_write fs/read_write.c:595 [inline]\n vfs_write+0x612/0xba0 fs/read_write.c:687\n ksys_write+0x150/0x270 fs/read_write.c:739\n do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]\n do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f173130ecb9\nCode: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffd67e44248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f173130ecb9\nRDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000003\nRBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd67e44388\nR13: 0000000000000002 R14: 00002000000000c0 R15: 0000000000000002\n </TASK>"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1","lessThan":"3e0cad1432a0c0564f5076bab16f1aa4c0474be4","versionType":"git","status":"affected"},{"version":"69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1","lessThan":"6d4d55f75fa0ea32d874eb33e356e9361f3e4591","versionType":"git","status":"affected"},{"version":"69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1","lessThan":"09e3c9b32434600a6992e762bf0d6837f5902134","versionType":"git","status":"affected"},{"version":"69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1","lessThan":"2b9fa12fbdbfc0f671ff23b0ea06c177a6b8a6b8","versionType":"git","status":"affected"},{"version":"69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1","lessThan":"c6b3db727876a027013aa4ccb6913a153a2af41a","versionType":"git","status":"affected"},{"version":"69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1","lessThan":"72abe77e88c3f1f71c5348124e9b28e285f26950","versionType":"git","status":"affected"},{"version":"69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1","lessThan":"9d714076ff398ba8cc5ae0ae146f4a1ea0bbf5e8","versionType":"git","status":"affected"},{"version":"69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1","lessThan":"73e594c19b4f815d8343461cec7074c4713bbde7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.31","status":"affected"},{"version":"0","lessThan":"2.6.31","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-681"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.31","versionEndExcluding":"5.10.271","matchCriteriaId":"3E4A704F-58F9-40EE-9D1A-9A4FA2B4B639"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.222","matchCriteriaId":"A5EFABC8-89EB-4EE7-9EE1-A9A30E730AFC"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.189","matchCriteriaId":"FE14E0F2-AE30-4319-B6E7-5D8B82530FD6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.158","matchCriteriaId":"575D98F4-AE0C-4D1F-91BC-CD1C75F0FED0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/09e3c9b32434600a6992e762bf0d6837f5902134","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/2b9fa12fbdbfc0f671ff23b0ea06c177a6b8a6b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/3e0cad1432a0c0564f5076bab16f1aa4c0474be4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/6d4d55f75fa0ea32d874eb33e356e9361f3e4591","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/72abe77e88c3f1f71c5348124e9b28e285f26950","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/73e594c19b4f815d8343461cec7074c4713bbde7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/9d714076ff398ba8cc5ae0ae146f4a1ea0bbf5e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/c6b3db727876a027013aa4ccb6913a153a2af41a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98096","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:39.373","lastModified":"2026-10-19T10:18:06.573","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: restore network header before routing and forwarding\n\nipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH)\nwhile skb_network_header() points at the IPv6 header.\n\nWhen segments_left > 0, ipv6_srh_rcv() previously restored the skb->data\nposition by pushing sizeof(struct ipv6hdr), assuming the SRH immediately\nfollowed the fixed IPv6 header. If another extension header (such as a\nHop-by-Hop options header) precedes the SRH, skb_network_offset()\nremained negative.\n\nThis led to two problems:\n1. During ip6_route_input(), fib6_rules_early_flow_dissect() invokes\n   __skb_flow_dissect() which passes the negative skb_network_offset()\n   to flow dissection, breaking BPF and C flow dissector logic.\n2. If forwarded via ip6_forward() or redirected via act_mirred, downstream\n   handlers (like sch_fragment() or neighbour output) pass the negative\n   offset as an unsigned length, triggering OOB memcpy or buffer overflows.\n\nFix this by pushing -skb_network_offset(skb) before routing, ensuring\nskb_network_offset(skb) is 0 for route lookup / flow dissection as well as\ndownstream forwarding. On the loopback path, pull skb_transport_offset(skb)\nto restore skb->data to the SRH before looping back."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/exthdrs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1ababeba4a21f3dba3da3523c670b207fb2feb62","lessThan":"f463c4786cf27376de7dfc0833a12e924a98f698","versionType":"git","status":"affected"},{"version":"1ababeba4a21f3dba3da3523c670b207fb2feb62","lessThan":"8f44d4160bcdb3136a9145a4b9c7816382976925","versionType":"git","status":"affected"},{"version":"1ababeba4a21f3dba3da3523c670b207fb2feb62","lessThan":"9cfbe2c381ab6d00a08e7a5b6028865adfb4e1bc","versionType":"git","status":"affected"},{"version":"1ababeba4a21f3dba3da3523c670b207fb2feb62","lessThan":"af08f62b5a5a446d6134a92d86771d3d12e0e3da","versionType":"git","status":"affected"},{"version":"1ababeba4a21f3dba3da3523c670b207fb2feb62","lessThan":"ce4c8beedc19aceeab0e7bdc6f34394fb158c47c","versionType":"git","status":"affected"},{"version":"1ababeba4a21f3dba3da3523c670b207fb2feb62","lessThan":"97b21ef57dfabbff660a4672c9fef7edfb720f47","versionType":"git","status":"affected"},{"version":"1ababeba4a21f3dba3da3523c670b207fb2feb62","lessThan":"3ad7dca5e03bd64c65983a19734337512fd75491","versionType":"git","status":"affected"},{"version":"1ababeba4a21f3dba3da3523c670b207fb2feb62","lessThan":"975b5b067f525a1b1338c4a3bee1c46545801518","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/exthdrs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.10","status":"affected"},{"version":"0","lessThan":"4.10","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/3ad7dca5e03bd64c65983a19734337512fd75491","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f44d4160bcdb3136a9145a4b9c7816382976925","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/975b5b067f525a1b1338c4a3bee1c46545801518","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97b21ef57dfabbff660a4672c9fef7edfb720f47","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9cfbe2c381ab6d00a08e7a5b6028865adfb4e1bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af08f62b5a5a446d6134a92d86771d3d12e0e3da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce4c8beedc19aceeab0e7bdc6f34394fb158c47c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f463c4786cf27376de7dfc0833a12e924a98f698","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98097","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:39.490","lastModified":"2026-10-21T13:21:22.327","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Dont send random pad bytes in RESET/ACTIVATE messages\n\nThe interface name is passed in a fixed length (TIPC_MAX_IF_NAME) buffer.\nReplace the strcpy(data, l->if_name) with memcpy() so that the\npad bytes are actually written (l->if_name[] is zero padded)\nrather than sending random bytes from the skb to the remote system.\n\nReplace two other strcpy() with strscpy()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/tipc/link.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e74a386d70c793ef44678b44b021c99094b28c47","lessThan":"3dbb628cfc592a4148d8136dcda1f706cdcad4f3","versionType":"git","status":"affected"},{"version":"e74a386d70c793ef44678b44b021c99094b28c47","lessThan":"48033a89356b8ae21a94db70c79bb6fcc91a23c2","versionType":"git","status":"affected"},{"version":"e74a386d70c793ef44678b44b021c99094b28c47","lessThan":"4ab2977323d5f068a872126f7818d1aeb9e9ca0d","versionType":"git","status":"affected"},{"version":"e74a386d70c793ef44678b44b021c99094b28c47","lessThan":"bee1459e57f2e0bd240c62f35c0a284291e27971","versionType":"git","status":"affected"},{"version":"e74a386d70c793ef44678b44b021c99094b28c47","lessThan":"81c600c26302a27852ed8b19c5f2f647ea3555c9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/tipc/link.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.6","status":"affected"},{"version":"0","lessThan":"4.6","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3dbb628cfc592a4148d8136dcda1f706cdcad4f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/48033a89356b8ae21a94db70c79bb6fcc91a23c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4ab2977323d5f068a872126f7818d1aeb9e9ca0d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81c600c26302a27852ed8b19c5f2f647ea3555c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bee1459e57f2e0bd240c62f35c0a284291e27971","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98098","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:39.597","lastModified":"2026-10-19T10:18:06.933","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix NULL deref in tipc_named_node_up() on empty publication list\n\nUser-space applications can bind a large number of service addresses to\none or more sockets. Each binding of a local-scope service address inserts\none entry (publication) into the TIPC name table. If the number of these\npublications exceeds TIPC_MAX_PUBL (65535), protocol service types\n(such as node state and link state) are no longer inserted into the name\ntable. This causes two issues:\n\n1. User-space applications subscribing to node or link up/down events\n   stop receiving notifications.\n\n2. A NULL pointer dereference can occur:\n\n   BUG: kernel NULL pointer dereference, address: 00000000000000d0\n   ...\n   CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc4-default+ #5 PREEMPT(full)\n   ...\n   RIP: 0010:tipc_named_node_up (./include/linux/skbuff.h:2251 net/tipc/name_distr.c:195 net/tipc/name_distr.c:221)\n   ...\n   Call Trace:\n   <IRQ>\n   tipc_node_write_unlock (net/tipc/node.c:428)\n   tipc_rcv (net/tipc/node.c:934 net/tipc/node.c:2189)\n   tipc_udp_recv (net/tipc/udp_media.c:389)\n\n   Thread 1 (tipc_net_finalize) | Thread 2 (named_distribute)\n   -----------------------------|-----------------------------\n                                | ...\n                                | list_for_each_entry(publ, pls, binding_node) {\n                                | ...\n                                | __skb_queue_tail(list, skb);\n                                | ...\n                                | }\n                                | ...\n                                | hdr = buf_msg(skb_peek_tail(list));\n   ...                          |\n   tipc_nametbl_publish();      |\n\n   If 'tipc_nametbl_publish()' (Thread 1) fails because the number of\n   local publications reaches TIPC_MAX_PUBL, list (Thread 2) will be empty. As a\n   result, NULL is passed to 'buf_msg()', leading to a NULL pointer dereference.\n\nFix these issues by allowing protocol service types (node state, link state,\nand topology server) to be inserted into the name table unconditionally.\nThis ensures that users subscribing to these types always receive\nnotifications. In addition, the maximum number of local user publications is\nreduced to (TIPC_MAX_PUBL - 1). This ensures that the maximum bulk size\ncalculated in tipc_link_set_queue_limits() remains valid."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/tipc/name_table.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a5e7ac5ce134d8f72f59631011fafa7bbf7ca174","lessThan":"246a4b4aace490664927042e93400a6f940d197f","versionType":"git","status":"affected"},{"version":"a5e7ac5ce134d8f72f59631011fafa7bbf7ca174","lessThan":"6188cf0c989dea60f2efe800eaebb7d0bd16e2b2","versionType":"git","status":"affected"},{"version":"a5e7ac5ce134d8f72f59631011fafa7bbf7ca174","lessThan":"b5344e459996afb45e30fdc407b41e6674793b21","versionType":"git","status":"affected"},{"version":"a5e7ac5ce134d8f72f59631011fafa7bbf7ca174","lessThan":"68619f965329d2f7b113a3d5811aa23198f39105","versionType":"git","status":"affected"},{"version":"a5e7ac5ce134d8f72f59631011fafa7bbf7ca174","lessThan":"ad805326d874062f8bc72a94884f86046148cde3","versionType":"git","status":"affected"},{"version":"a5e7ac5ce134d8f72f59631011fafa7bbf7ca174","lessThan":"d0d82f1214f321143c5dbc2e48e4a4e6c4226895","versionType":"git","status":"affected"},{"version":"a5e7ac5ce134d8f72f59631011fafa7bbf7ca174","lessThan":"b3b76e9f4f2476f1135b2ba7743a821db4a0df4b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/tipc/name_table.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.15","status":"affected"},{"version":"0","lessThan":"3.15","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/246a4b4aace490664927042e93400a6f940d197f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6188cf0c989dea60f2efe800eaebb7d0bd16e2b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68619f965329d2f7b113a3d5811aa23198f39105","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad805326d874062f8bc72a94884f86046148cde3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b3b76e9f4f2476f1135b2ba7743a821db4a0df4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5344e459996afb45e30fdc407b41e6674793b21","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0d82f1214f321143c5dbc2e48e4a4e6c4226895","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98099","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:39.723","lastModified":"2026-10-21T13:21:22.493","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: use rcu_assign_pointer() for __rcu list updates\n\nSeveral places in net/ipv6/mcast.c update RCU-protected lists\n(np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer\nassignments instead of rcu_assign_pointer():\n\n1. In __ipv6_dev_mc_dec(), unlinking a group from idev->mc_list did:\n       *map = ma->next;\n   without rcu_assign_pointer() while concurrent readers traverse\n   idev->mc_list locklessly under rcu_read_lock().\n2. In ipv6_sock_mc_drop() and __ipv6_sock_mc_close(), unlinking a group\n   from np->ipv6_mc_list directly assigned *lnk = mc_lst->next and\n   np->ipv6_mc_list = mc_lst->next without rcu_assign_pointer(), racing\n   with lockless readers in inet6_mc_check().\n3. In __ipv6_sock_mc_join(), mc_lst->next was initialized to\n   np->ipv6_mc_list via raw assignment before publishing mc_lst.\n4. In mld_del_delrec() and __ipv6_dev_mc_inc(), __rcu source pointers\n   passed into rcu_assign_pointer() lacked explicit dereference helpers.\n\nFix these by consistently using rcu_assign_pointer() along with\nmc_dereference() / sock_dereference()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/mcast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"456b61bca8ee324ab6c18b065e632c9a8c88aa39","lessThan":"0e3e3cec28c4d1bf29948da40b4e9e5d44f7852b","versionType":"git","status":"affected"},{"version":"456b61bca8ee324ab6c18b065e632c9a8c88aa39","lessThan":"49d7e1b456ba2f3ee08b3e264d999c09992cde8e","versionType":"git","status":"affected"},{"version":"456b61bca8ee324ab6c18b065e632c9a8c88aa39","lessThan":"afca229b39acc2590976b3e4f6e0fe76cededc60","versionType":"git","status":"affected"},{"version":"456b61bca8ee324ab6c18b065e632c9a8c88aa39","lessThan":"2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6","versionType":"git","status":"affected"},{"version":"456b61bca8ee324ab6c18b065e632c9a8c88aa39","lessThan":"0c8f56c583c3250408367880c98e4d6fbc929315","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/mcast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.38","status":"affected"},{"version":"0","lessThan":"2.6.38","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0c8f56c583c3250408367880c98e4d6fbc929315","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0e3e3cec28c4d1bf29948da40b4e9e5d44f7852b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/49d7e1b456ba2f3ee08b3e264d999c09992cde8e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/afca229b39acc2590976b3e4f6e0fe76cededc60","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98101","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:39.830","lastModified":"2026-10-19T10:18:07.260","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()\n\npmc->sflist is read locklessly under rcu_read_lock() by\ninet6_mc_check() during packet reception in the UDP and RAW\nmulticast receive paths.\n\nip6_mc_source() mutated psl->sl_addr and psl->sl_count in-place\nwhen adding or removing a source filter. Additionally, when expanding\nthe filter buffer, newpsl was published via rcu_assign_pointer()\nbefore writing the new source into the array.\n\nBecause 16-byte struct in6_addr writes are not atomic and array\nshifting is not synchronized with RCU readers, concurrent readers in\ninet6_mc_check() could read torn IPv6 addresses or observe\nduplicated/missed source entries.\n\nFix this by switching ip6_mc_source() to copy-on-write RCU updates:\nallocate and fully populate newpsl before publishing it via\nrcu_assign_pointer(), and reclaim the old filter via kfree_rcu(),\nmatching ip6_mc_msfilter().\n\nAlso remove the now unused IP6_SFBLOCK macro."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/if_inet6.h","net/ipv6/mcast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"882ba1f73c06831f2a21044ebd8864c485ac04f2","lessThan":"ac51321d3b2391860a935820ebcf4d8b9bb16a8a","versionType":"git","status":"affected"},{"version":"882ba1f73c06831f2a21044ebd8864c485ac04f2","lessThan":"dba00514bf668c26cb4900e9f0da84bf96bf065a","versionType":"git","status":"affected"},{"version":"882ba1f73c06831f2a21044ebd8864c485ac04f2","lessThan":"2c2091e2ee93049fc513ad1e6c99d8b6c809f467","versionType":"git","status":"affected"},{"version":"882ba1f73c06831f2a21044ebd8864c485ac04f2","lessThan":"20db91a052332ef5552bd2f651ffb9db911cf67b","versionType":"git","status":"affected"},{"version":"882ba1f73c06831f2a21044ebd8864c485ac04f2","lessThan":"c073d1b070f171d206b19c98d71739a97f15b3f1","versionType":"git","status":"affected"},{"version":"47c75e3923c8d562fea8daf0ccf31546a7bef0ea","versionType":"git","status":"affected"},{"version":"5.10.261","lessThan":"5.11","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/if_inet6.h","net/ipv6/mcast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/20db91a052332ef5552bd2f651ffb9db911cf67b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c2091e2ee93049fc513ad1e6c99d8b6c809f467","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac51321d3b2391860a935820ebcf4d8b9bb16a8a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c073d1b070f171d206b19c98d71739a97f15b3f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dba00514bf668c26cb4900e9f0da84bf96bf065a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98102","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:39.943","lastModified":"2026-10-19T10:18:07.420","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()\n\nWhen removing a source filter whose count reaches zero, ip6_mc_del1_src()\nunlinks psf from pmc->mca_sources. If the filter was previously active,\nthe code moved psf directly into pmc->mca_tomb by updating psf->sf_next.\n\nBecause pmc->mca_sources is traversed locklessly under RCU (e.g. by\nipv6_chk_mcast_addr()), mutating psf->sf_next before a grace period\nelapses diverts concurrent readers to the tombstone list. Consequently,\nreaders miss remaining active sources in pmc->mca_sources and improperly\nexamine deleted tombstone entries.\n\nFix this by allocating a new tombstone node for pmc->mca_tomb (as done\nin sf_setstate()) and retiring the original psf via kfree_rcu()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/mcast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4b200e398953c237c86d32bf26d4cb2a96556a6f","lessThan":"c3343cd7ec8706c221e52b782f386b9af14a928a","versionType":"git","status":"affected"},{"version":"4b200e398953c237c86d32bf26d4cb2a96556a6f","lessThan":"4352737297b262e8367675c19a7dc6a9f53c97af","versionType":"git","status":"affected"},{"version":"4b200e398953c237c86d32bf26d4cb2a96556a6f","lessThan":"8d4fe5c13f5056faa6deb09a90e24a89f9ebfad4","versionType":"git","status":"affected"},{"version":"4b200e398953c237c86d32bf26d4cb2a96556a6f","lessThan":"5149c60c406595b56fda0c6e9aae7fd287f636aa","versionType":"git","status":"affected"},{"version":"4b200e398953c237c86d32bf26d4cb2a96556a6f","lessThan":"93b49239840b91313adbd77b8b52993eff2d08c1","versionType":"git","status":"affected"},{"version":"86c49119f0353f857cc08030ec9e4ebaab3d5a64","versionType":"git","status":"affected"},{"version":"5.10.261","lessThan":"5.11","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/mcast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4352737297b262e8367675c19a7dc6a9f53c97af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5149c60c406595b56fda0c6e9aae7fd287f636aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8d4fe5c13f5056faa6deb09a90e24a89f9ebfad4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/93b49239840b91313adbd77b8b52993eff2d08c1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3343cd7ec8706c221e52b782f386b9af14a928a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98103","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:40.613","lastModified":"2026-10-21T13:21:22.667","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nigmp: convert struct ip_sf_list to RCU\n\nCommit 23d2b94043ca (\"igmp: Add ip_mc_list lock in ip_check_mc_rcu\")\nadded spin_lock_bh(&im->lock) to ip_check_mc_rcu() to prevent a\nuse-after-free while iterating im->sources during concurrent deletions.\n\nHowever, ip_check_mc_rcu() is called from RCU read-side critical\nsections in packet receive and route lookup fast paths (e.g.\n__mkroute_output(), ip_route_input_rcu(), and __udp4_lib_rcv()).\n\nWhen igmpv3_send_cr() or igmpv3_send_report() holds &pmc->lock and\ncalls add_grec() -> igmpv3_newpack() -> ip_route_output_ports(),\nan XFRM policy matching a multicast destination triggers\nxfrm_tmpl_resolve_one() -> xfrm4_get_saddr() -> __mkroute_output() ->\nip_check_mc_rcu(). This attempts to acquire &im->lock while &pmc->lock\nis already held on the same CPU, triggering a lockdep recursive locking\nwarning / deadlock.\n\nFix this by converting IPv4 struct ip_sf_list to RCU, mirroring the\nIPv6 implementation in net/ipv6/mcast.c:\n\n1. Add struct rcu_head to struct ip_sf_list and annotate sf_next,\n   sources, and tomb as __rcu pointers.\n2. Use rcu_assign_pointer() and kfree_rcu() for list updates and\n   deletions.\n3. Remove spin_lock_bh(&im->lock) from ip_check_mc_rcu() and traverse\n   im->sources locklessly with for_each_psf_rcu(), reading and writing\n   counter fields with READ_ONCE() and WRITE_ONCE().\n\nNote: RCU conversion of /proc/net/mcfilter will be done in a\nseparate patch."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/igmp.h","net/ipv4/igmp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"23d2b94043ca8835bd1e67749020e839f396a1c2","lessThan":"01131daffc4b64f1652e23dc3e6e2f601eda781d","versionType":"git","status":"affected"},{"version":"23d2b94043ca8835bd1e67749020e839f396a1c2","lessThan":"f5182dfad54277267a8cb0c004a9cd4cf35aeebb","versionType":"git","status":"affected"},{"version":"23d2b94043ca8835bd1e67749020e839f396a1c2","lessThan":"d3011d1f293478c730aa0870490afa145c37600e","versionType":"git","status":"affected"},{"version":"23d2b94043ca8835bd1e67749020e839f396a1c2","lessThan":"e3206419bdb04e2087d8cc6be324df8639b3fac5","versionType":"git","status":"affected"},{"version":"23d2b94043ca8835bd1e67749020e839f396a1c2","lessThan":"2987ee196c88dbde0463dc87d5fb209c684e34a2","versionType":"git","status":"affected"},{"version":"b24065948ae6c48c9e20891f8cfe9850f1d748be","versionType":"git","status":"affected"},{"version":"e9924c4204ede999b0515fd31a370a1e27f676bc","versionType":"git","status":"affected"},{"version":"78967749984cf3614de346c90f3e259ff8272735","versionType":"git","status":"affected"},{"version":"4768973dffed4d0126854514335ed4fe87bec1ab","versionType":"git","status":"affected"},{"version":"d84708451d9041dff8a81e3718f821f12d2eb6c5","versionType":"git","status":"affected"},{"version":"ddd7e8b7b84836c584a284b98ca9bd7a348a0558","versionType":"git","status":"affected"},{"version":"961447ff60291b91e27d5c32fa549c1411ad3b70","versionType":"git","status":"affected"},{"version":"d1a3c6d5925a8d00a32c5ef2d674dd9c0ce89c95","versionType":"git","status":"affected"},{"version":"4.4.284","lessThan":"4.5","versionType":"semver","status":"affected"},{"version":"4.9.283","lessThan":"4.10","versionType":"semver","status":"affected"},{"version":"4.14.247","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.207","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.145","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.10.64","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.13.16","lessThan":"5.14","versionType":"semver","status":"affected"},{"version":"5.14.3","lessThan":"5.15","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/igmp.h","net/ipv4/igmp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/01131daffc4b64f1652e23dc3e6e2f601eda781d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2987ee196c88dbde0463dc87d5fb209c684e34a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3011d1f293478c730aa0870490afa145c37600e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3206419bdb04e2087d8cc6be324df8639b3fac5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5182dfad54277267a8cb0c004a9cd4cf35aeebb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98104","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:40.793","lastModified":"2026-10-19T10:18:07.770","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: fix duplicate handle when node ID pool is exhausted\n\ngen_new_kid() falls back to returning max (htid | 0xFFF) when both\nidr_alloc_u32() ranges are full, instead of reporting an error.\nu32_change() trusts that value and inserts a new knode with a handle\nthat is already live in the hash table, breaking handle uniqueness\nwithin the table's node ID space.\n\nThe handle was never reserved in ht->handle_idr, so every later error\npath that does idr_remove(&ht->handle_idr, handle) removes the\nreservation of a different, live knode, which is then reused — one\nfailed add compounds into further duplicates.\n\nThe 4095 limit is per (table, bucket) — ht->handle_idr is per hash\ntable and the range is derived from htid (bucketid), so a table with\ndivisor 256 can legitimately hold 256*4095 knodes.\n\nThe sibling helper gen_new_htid() has the same silent in-band failure:\nit returns 0 when the tp_c handle pool (1..0x7FF) is full, and\nu32_init() publishes the root hash table with handle 0 without\nchecking.  Two root tables with handle 0 alias in u32_lookup_ht(),\nallowing cross-tcf_proto knode add/lookup/delete.  Add the same\nexhaustion check that the divisor path already has.\n\nReturn an error so u32_change() fails with ENOSPC/ENOMEM when the\nnode ID space is exhausted, and so u32_init() fails with -ENOMEM\nwhen the hash table ID space is exhausted.  The extack message\ndistinguishes pool exhaustion (-ENOSPC) from a transient allocation\nfailure (-ENOMEM).\n\nConditions to recreate the bug:\n- CONFIG_NET_SCHED=y, CONFIG_CLS_U32=y (or =m with module loaded)\n- Create a clsact qdisc on a device, then add 4095 u32 filters with\n  auto-generated handles to fill the node ID space for the root hash\n  table (single bucket). The 4096th auto-handle filter add triggers\n  the duplicate handle (fh 800::fff reused). Reachable at Level 2\n  (unshare -Urn, namespace-local CAP_NET_ADMIN).\n- For gen_new_htid: create 2047 u32 proto entries on the same block\n  to fill the tp_c handle pool, then create one more. The root table\n  gets handle 0 and aliases with other handle-0 root tables."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sched/cls_u32.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7801db8aec957fa6610efe0ee26a6c8bc0f1d73b","lessThan":"f4ee13ed7f7b22dcd8287fcf477ae37bd84567da","versionType":"git","status":"affected"},{"version":"7801db8aec957fa6610efe0ee26a6c8bc0f1d73b","lessThan":"84223baf21bc9b008444ae9bc38d5fb91fe00b9d","versionType":"git","status":"affected"},{"version":"7801db8aec957fa6610efe0ee26a6c8bc0f1d73b","lessThan":"6890e28840bae4f6805e8de981c4ec8e12a4e064","versionType":"git","status":"affected"},{"version":"7801db8aec957fa6610efe0ee26a6c8bc0f1d73b","lessThan":"feab9261b537df4ebb8350e4779bc185373059fd","versionType":"git","status":"affected"},{"version":"7801db8aec957fa6610efe0ee26a6c8bc0f1d73b","lessThan":"f594f04268d01c5fdc975f3f51fc219ea2159ac6","versionType":"git","status":"affected"},{"version":"7801db8aec957fa6610efe0ee26a6c8bc0f1d73b","lessThan":"d7e7e98d23f42a92d9ab7e36302bd96bd9b33b5f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sched/cls_u32.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.16","status":"affected"},{"version":"0","lessThan":"3.16","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6890e28840bae4f6805e8de981c4ec8e12a4e064","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/84223baf21bc9b008444ae9bc38d5fb91fe00b9d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7e7e98d23f42a92d9ab7e36302bd96bd9b33b5f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f4ee13ed7f7b22dcd8287fcf477ae37bd84567da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f594f04268d01c5fdc975f3f51fc219ea2159ac6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/feab9261b537df4ebb8350e4779bc185373059fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98105","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:40.987","lastModified":"2026-10-19T10:18:07.947","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: oa_tc6: Improve the error recovery\n\nWhen oversubscribed traffic causes lot of buffer overflow errors,\nprobably due to loss of data chunks, driver fails to find a\ndata chunk with end_valid bit set, before it runs out of sk buffer\nspace. As a result, assert is seen during skb_put.\n\nNow, check is made if skb buffer has enough tailroom for the\nincoming data before accepting. If there is no room, current\nframe is abandoned and it will start looking for a data chunk\nwith start_valid bit, that is a new frame.\n\nSK buffer allocation error is considered as recoverable error.\n\nrx_buf_overflow flag is too specific and no longer the only\ncondition this flag is used for. Therefore it is renamed as\nwait_until_start_valid. This is more appropriate as this flag\nis used to look for the next data chunk with SV bit set, after\nfailures like buffer overflow, buffer allocation failure, skb pointer\nvalidity besides buffer overflow error.\n\nNot writing to status0 if it reads 0."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/oa_tc6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d70a0d8f2f2d1b9bb6e3e9dfed25ae3ca3303770","lessThan":"d33003e752f25c385f2cf21964123582a44f6818","versionType":"git","status":"affected"},{"version":"d70a0d8f2f2d1b9bb6e3e9dfed25ae3ca3303770","lessThan":"9d3f6e714d5f8b728837f31bbe865b64cfd3216a","versionType":"git","status":"affected"},{"version":"d70a0d8f2f2d1b9bb6e3e9dfed25ae3ca3303770","lessThan":"b89770d493749d7c3b8649996e1089719b4eff8d","versionType":"git","status":"affected"},{"version":"d70a0d8f2f2d1b9bb6e3e9dfed25ae3ca3303770","lessThan":"172c974113bffe5723b80b1acac17593bb50513c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/oa_tc6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/172c974113bffe5723b80b1acac17593bb50513c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d3f6e714d5f8b728837f31bbe865b64cfd3216a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b89770d493749d7c3b8649996e1089719b4eff8d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d33003e752f25c385f2cf21964123582a44f6818","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98106","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:41.110","lastModified":"2026-10-19T10:18:08.090","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/pagemap: Prevent double migration of device pages\n\nA device-private folio migrated to system memory by a CPU fault can\nremain reachable through the raw-PFN eviction path until migration\nfinalization drops the source reference.\n\nIf eviction selects the same device-private folio during this window,\nit can attempt to migrate the folio again. The second migration can leave\nan uncharged folio on an LRU list, causing folio_lruvec_lock_irqsave() to\nretry indefinitely and resulting in a soft lockup and RCU stall.\n\nMark successfully migrated device-private folios using a low bit of\ntheir zone_device_data before migration finalization. Make both CPU-fault\nand raw-PFN migration paths skip device-private folios carrying this\nflag.\n\nMask the flag when retrieving the drm_pagemap_zdd pointer and preserve\nit when a device-private folio is split. Keeping the state on the physical\nfolio also avoids depending on a virtual address that may change before a\nfault occurs.\n\nv2:\n- Replace the retired-PFN XArray with an embedded bitmap. (Matthew Brost)\n- Mark every base page covered by a migrated folio so retirement remains\n  valid if the folio is later split.\n\nv3:\n- Store the migrated state in a low bit of zone_device_data instead of\n  adding virtual-range and bitmap tracking to the ZDD. (Matthew Brost)\n- Mask the flag when retrieving the ZDD and preserve it when splitting\n  a folio.\n- Drop the pre-existing fixes already covered by Matthew Brost's series:\n  https://patchwork.freedesktop.org/series/171651/\n\nv4:\n- Advance by the folio size only for migration entries marked with\n  MIGRATE_PFN_COMPOUND. (Sashiko)\n\nv5:\n- Simplify ZDD flag updates and folio iteration. (Matthew Brost)\n- Skip retired device-private folios in the CPU-fault path. (Matthew Brost)\n- Preserve flag bits while taking a new ZDD reference for split folios.\n\nv6:\n- Restore MIGRATE_PFN_COMPOUND-aware stepping so non-compound migration\n  entries are processed one at a time. (Sashiko)\n- Drop the pre-existing fixes already covered by Matthew Brost's series:\n  https://patchwork.freedesktop.org/series/171651/\n\nThe lockup was observed as:\n[10109.860465] watchdog: BUG: soft lockup - CPU#9 stuck for 26s! [kworker/u65:5:6557]\n[10109.860524] Tainted: [S]=CPU_OUT_OF_SPEC, [O]=OOT_MODULE\n[10109.860524] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 0812 02/24/2023\n[10109.860525] Workqueue: xe_page_fault_work_queue xe_pagefault_queue_work [xe]\n[10109.860644] RIP: 0010:_raw_spin_unlock_irqrestore+0x57/0x80\n[10109.860655] Call Trace:\n[10109.860655]  <TASK>\n[10109.860657]  folio_lruvec_lock_irqsave+0x216/0x220\n[10109.860661]  ? __pfx_lru_add+0x10/0x10\n[10109.860665]  folio_batch_move_lru+0xc8/0x450\n[10109.860670]  ? lock_acquire+0xc4/0x2d0\n[10109.860674]  ? __folio_batch_add_and_move+0x60/0x2e0\n[10109.860677]  ? folio_migrate_mapping+0xa6/0x110\n[10109.860679]  ? folio_migrate_flags+0x13b/0x1b0\n[10109.860681]  ? __pfx_lru_add+0x10/0x10\n[10109.860683]  __folio_batch_add_and_move+0xe7/0x2e0\n[10109.860685]  ? dma_iova_try_alloc+0xb0/0x140\n[10109.860689]  folio_add_lru+0x64/0x80\n[10109.860691]  __migrate_device_finalize+0x12c/0x270\n[10109.860695]  migrate_device_finalize+0x10/0x20\n[10109.860698]  drm_pagemap_evict_to_ram+0x185/0x370 [drm_gpusvm_helper]\n[10109.860704]  ? drm_pagemap_evict_to_ram+0x96/0x370 [drm_gpusvm_helper]\n[10109.860709]  xe_svm_bo_evict+0x15/0x20 [xe]\n[10109.860819]  ? xe_svm_bo_evict+0x15/0x20 [xe]\n[10109.860921]  xe_bo_move+0x107e/0x1570 [xe]\n[10109.860992]  ? xe_ttm_tt_create+0x168/0x340 [xe]\n[10109.861059]  ? __up_read+0x98/0x2b0\n[10109.861061]  ? lock_is_held_type+0xa3/0x130\n[10109.861067]  ttm_bo_handle_move_mem+0xe8/0x1e0 [ttm]\n[10109.861075]  ttm_bo_evict+0x141/0x1c0 [ttm]\n[10109.861081]  ttm_bo_evict_cb+0x9f/0x100 [ttm]\n[10109.861086]  ttm_lru_walk_for_evict+0x84/0x190 [ttm]\n[10109.861091]  ? xe_ttm_vram_mgr_new+0x258/0x3a0 [xe]\n[10109.861198]  ttm_bo_alloc_resource+0x219/0\n---truncated---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/drm_pagemap.c","include/drm/drm_pagemap.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"99624bdff8670795b678eafa6509aaad3a5c0175","lessThan":"62451f540c46bf5c51143a1c8681b472608bd54d","versionType":"git","status":"affected"},{"version":"99624bdff8670795b678eafa6509aaad3a5c0175","lessThan":"c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/drm_pagemap.c","include/drm/drm_pagemap.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/62451f540c46bf5c51143a1c8681b472608bd54d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98107","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:41.743","lastModified":"2026-10-21T13:21:22.877","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect\n\nl2cap_chan_connect() tries to ensure there are no more than\nL2CAP_ECRED_CONN_SCID_MAX pending ECRED channels, so they fit in the\nsame L2CAP_ECRED_CONN_REQ that l2cap_ecred_connect() constructs.\n\nHowever, the check only counts deferred channels.  If 6 L2CAP sockets\nare connected at the same time in order DDDDND (D=deferred,\nN=non-deferred), the last can bump the total to max+1.  It results to\none __le16 written out of bounds of the scid array, and an invalid\nECRED_CONN_REQ being sent.\n\nFix by leaving room for the non-deferred pending ECRED channels in the\ncounting in l2cap_chan_connect(), so the limit can't be exceeded.\n\nMove counting under same critical section where the channel is added.\nAlthough race conditions involving this appear unreachable, it's easier\nto see.\n\nAlso add WARN_ON_ONCE check in l2cap_ecred_defer_connect() to make this\nless brittle."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"da49b602f7f75ccc91386e1274b3ef71676cd092","lessThan":"fabc5e04f123225daf980d03f2c5a05e7f0f0a7f","versionType":"git","status":"affected"},{"version":"da49b602f7f75ccc91386e1274b3ef71676cd092","lessThan":"ce0927eb3ee2939fab5ce3f9334bfd2fafb38481","versionType":"git","status":"affected"},{"version":"da49b602f7f75ccc91386e1274b3ef71676cd092","lessThan":"6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65","versionType":"git","status":"affected"},{"version":"da49b602f7f75ccc91386e1274b3ef71676cd092","lessThan":"df8c3af6132640da4788e96a02d653e642059803","versionType":"git","status":"affected"},{"version":"da49b602f7f75ccc91386e1274b3ef71676cd092","lessThan":"56c2b5831d39dc84aad2573dc3e197af1a872a05","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/56c2b5831d39dc84aad2573dc3e197af1a872a05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce0927eb3ee2939fab5ce3f9334bfd2fafb38481","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df8c3af6132640da4788e96a02d653e642059803","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fabc5e04f123225daf980d03f2c5a05e7f0f0a7f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98108","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:41.863","lastModified":"2026-10-19T10:18:08.400","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan\n\nl2cap_new_connection() sets default value of channel mode to match the\nparent channel.  l2cap_le_connect_req() left this at the default, and\ncreated L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that\nmode.  This causes FLAG_DEFER_SETUP channels to reply to\nL2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect.\n\nIt can also result to stack OOB write (of l2cap_alloc_cid determined\nvalues) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not\nlimit maximum number of deferred channels or check for duplicate ident.\n\nFix by setting chan->mode correctly in l2cap_le_connect_req().\n\nAlso check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE\ninstead of OOB write to make it less brittle."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"ad0f44a3f1f688558ed876a0702bc2c82b0df689","versionType":"git","status":"affected"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"564ae0e05e598aa895b9dbd18cb7d6eb64752869","versionType":"git","status":"affected"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"aab17938998b29e75c3324763411aef3e300fc67","versionType":"git","status":"affected"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"0e1fc7cab95ad958e55d70a5dfaaea687c9c639f","versionType":"git","status":"affected"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"1074bcc57f741223f9fa82ce6afe5c3d783e4d10","versionType":"git","status":"affected"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1","versionType":"git","status":"affected"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"6cb79e6499228cfdbd4b3301371ce74d01cd2f80","versionType":"git","status":"affected"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"4ef05db5b08b176a551b4a6287372045998806b0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0e1fc7cab95ad958e55d70a5dfaaea687c9c639f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1074bcc57f741223f9fa82ce6afe5c3d783e4d10","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4ef05db5b08b176a551b4a6287372045998806b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/564ae0e05e598aa895b9dbd18cb7d6eb64752869","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6cb79e6499228cfdbd4b3301371ce74d01cd2f80","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aab17938998b29e75c3324763411aef3e300fc67","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad0f44a3f1f688558ed876a0702bc2c82b0df689","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98109","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:41.977","lastModified":"2026-10-19T10:18:08.593","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix race condition during device registration\n\nIn hci_register_dev(), the power_on work item is queued to\nhdev->req_workqueue before initializing hdev->adv_monitors_idr and\nregistering the MSFT extension via msft_register(). For devices marked with\nquirks such as HCI_QUIRK_RAW_DEVICE, the HCI_UNCONFIGURED flag is set on\nthe device. When the power_on work item runs concurrently on another CPU,\nhci_power_on() detects that the device is unconfigured and immediately\ninvokes hci_dev_do_close(), which calls msft_do_close().\n\nConcurrently, msft_register() allocates the msft structure and exposes it\nto hdev->msft_data prior to calling mutex_init(&msft->filter_lock). If\nmsft_do_close() executes while hdev->msft_data is already assigned but the\nmutex has not yet been initialized, mutex_lock(&msft->filter_lock) operates\non an uninitialized mutex, triggering a DEBUG_LOCKS warning:\n\nDEBUG_LOCKS_WARN_ON(lock->magic != lock)\nWARNING: kernel/locking/mutex.c:625 at __mutex_lock_common\nkernel/locking/mutex.c:625 [inline]\nWARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x12d8/0x1550\nkernel/locking/mutex.c:821\n...\nCall Trace:\n <TASK>\n msft_do_close+0x308/0x7b0 net/bluetooth/msft.c:693\n hci_dev_close_sync+0x86b/0x10a0 net/bluetooth/hci_sync.c:5522\n hci_dev_do_close net/bluetooth/hci_core.c:499 [inline]\n hci_power_on+0x32c/0x750 net/bluetooth/hci_core.c:937\n process_one_work kernel/workqueue.c:3322 [inline]\n process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405\n worker_thread+0x92d/0xe10 kernel/workqueue.c:3486\n kthread+0x388/0x470 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n </TASK>\n\nFix this by moving the queue_work() call in hci_register_dev() to after\nidr_init(&hdev->adv_monitors_idr) and msft_register(hdev) so that device\nstructures and extensions are fully initialized before asynchronous tasks\ncan access them. Additionally, assign hdev->msft_data in msft_register()\nonly after mutex_init(&msft->filter_lock) has completed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/hci_core.c","net/bluetooth/msft.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9e14606d8f38ea52a38c27692a9c1513c987a5da","lessThan":"593e64f64a20b25e4042c3ee863119eb7f991785","versionType":"git","status":"affected"},{"version":"9e14606d8f38ea52a38c27692a9c1513c987a5da","lessThan":"b1faf348c29e6f8302ec7769cbf1c1ef05be014f","versionType":"git","status":"affected"},{"version":"9e14606d8f38ea52a38c27692a9c1513c987a5da","lessThan":"a11ebe8dc0333fb870bbbb656b34690e87ee3f98","versionType":"git","status":"affected"},{"version":"9e14606d8f38ea52a38c27692a9c1513c987a5da","lessThan":"d427b1c71d9798083e954d3c13469dc0a2305868","versionType":"git","status":"affected"},{"version":"9e14606d8f38ea52a38c27692a9c1513c987a5da","lessThan":"57938bbdb9bf7fd41cbd5cd509ec10c4b22bec18","versionType":"git","status":"affected"},{"version":"f9965f7f38c90449a5fb26edb8a7d22b1dcf0283","versionType":"git","status":"affected"},{"version":"80fe27811c56ecd3896c3d511ab8298146071d98","versionType":"git","status":"affected"},{"version":"6.4.16","lessThan":"6.5","versionType":"semver","status":"affected"},{"version":"6.5.3","lessThan":"6.6","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/hci_core.c","net/bluetooth/msft.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.16","versionEndExcluding":"6.5","matchCriteriaId":"A5099559-2D15-42A5-A561-71B34FEFF36F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5.3","versionEndExcluding":"6.12.111","matchCriteriaId":"1FEF43D9-B4ED-4C7D-B51F-5608708BA08C"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/57938bbdb9bf7fd41cbd5cd509ec10c4b22bec18","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/593e64f64a20b25e4042c3ee863119eb7f991785","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a11ebe8dc0333fb870bbbb656b34690e87ee3f98","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/b1faf348c29e6f8302ec7769cbf1c1ef05be014f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d427b1c71d9798083e954d3c13469dc0a2305868","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98110","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:42.113","lastModified":"2026-10-19T10:18:08.773","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: bound firmware ID by TLV length\n\nThe firmware ID is treated as a NUL-terminated string even though the\nTLV length is its only boundary. If the value does not contain a NUL\nterminator, snprintf() can read beyond the received response.\n\nLimit the conversion to the advertised TLV value length."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/bluetooth/btintel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"164c62f958f8c7f0bde1e9a5a8677971c6f28205","lessThan":"aef56a2bd5aa22808ce508605d7497d2b5e8eb5f","versionType":"git","status":"affected"},{"version":"164c62f958f8c7f0bde1e9a5a8677971c6f28205","lessThan":"058f56de5f48ba4b3be01526006ac83ce9e79f39","versionType":"git","status":"affected"},{"version":"164c62f958f8c7f0bde1e9a5a8677971c6f28205","lessThan":"a07b3024a927892dd46e7dfbed438e8834e24098","versionType":"git","status":"affected"},{"version":"164c62f958f8c7f0bde1e9a5a8677971c6f28205","lessThan":"ac8aa9e0ec93a12a60230066f199f49c3b9aac3d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/bluetooth/btintel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/058f56de5f48ba4b3be01526006ac83ce9e79f39","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a07b3024a927892dd46e7dfbed438e8834e24098","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac8aa9e0ec93a12a60230066f199f49c3b9aac3d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aef56a2bd5aa22808ce508605d7497d2b5e8eb5f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98111","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:42.223","lastModified":"2026-10-19T10:18:08.927","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: validate version TLV value lengths\n\nbtintel_parse_version_tlv() verifies that a complete TLV is present in\nthe response, but it does not ensure that the value is long enough for\nthe specific TLV type. A short value can therefore cause an\nout-of-bounds read through get_unaligned_le16(), get_unaligned_le32(),\nor memcpy().\n\nReject values shorter than the minimum required by each known TLV type.\nAlso reject responses that do not contain the Command Complete Status\nfield."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/bluetooth/btintel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"57375beef71af9f245e88357fa71d9600650cb7d","lessThan":"e9cf7f175c00d36b060828f4eac8d2e246ee079b","versionType":"git","status":"affected"},{"version":"57375beef71af9f245e88357fa71d9600650cb7d","lessThan":"83499ac3ca62e43ed40f7574b13ed398a6891511","versionType":"git","status":"affected"},{"version":"57375beef71af9f245e88357fa71d9600650cb7d","lessThan":"76948d207d0978a613ce06a05cba07284a5578a7","versionType":"git","status":"affected"},{"version":"57375beef71af9f245e88357fa71d9600650cb7d","lessThan":"5ec43df2830b73e004147303bf7914ca884d6770","versionType":"git","status":"affected"},{"version":"57375beef71af9f245e88357fa71d9600650cb7d","lessThan":"a086c0892969bf8a0151b0f12bd14a68827c88b2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/bluetooth/btintel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5ec43df2830b73e004147303bf7914ca884d6770","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/76948d207d0978a613ce06a05cba07284a5578a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83499ac3ca62e43ed40f7574b13ed398a6891511","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a086c0892969bf8a0151b0f12bd14a68827c88b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9cf7f175c00d36b060828f4eac8d2e246ee079b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98112","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:42.340","lastModified":"2026-10-19T10:18:09.073","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix listener task lifetime on netdev events\n\nThe listener thread exits when its listening socket is shutdown. The\nnetdevice notifier shuts down the socket before calling kthread_stop(), so\nthe task_struct can be freed before kthread_stop() gets its reference.\n\nCreate the listener in a stopped state and hold an extra task_struct\nreference until kthread_stop_put() completes. Also stop and release\nlisteners before freeing their interface records during TCP teardown."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/transport_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3316a8fc840d82fad5efcf76ad0ea3f76fdca209","lessThan":"40581f10c1e56238b157af5f260b8f9518a0cbc1","versionType":"git","status":"affected"},{"version":"3316a8fc840d82fad5efcf76ad0ea3f76fdca209","lessThan":"a506290f59e1c6ce9ac0a13158640bb8fee93471","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/transport_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/40581f10c1e56238b157af5f260b8f9518a0cbc1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a506290f59e1c6ce9ac0a13158640bb8fee93471","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98113","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:42.450","lastModified":"2026-10-19T10:18:09.233","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: rate limit unmapped SID errors\n\nA client can include many structurally valid but unmapped SIDs in a DACL.\nLogging every mapping failure lets one request generate hundreds of kernel\nerror messages.\n\nRate limit the message to prevent an authenticated client from flooding\nthe kernel log."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"3005d43143096321cc857645a9d48ef4ffde8bcf","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"674aabf554bdaffcf25f145bf32c8b4f510f7916","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"486876f957456721b5e51af532235db4c6f7bd47","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"13af319c1efec0b45fb5c1b16830eb0888b3fd1e","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"30dbb08777b9a611d7d9193c040f382fbd0e7562","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"54cb2a909996346ac6a8a3beac96c07b3dcba584","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"feca5e70fc963b088377b20879e8cd8237c2fd7d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/13af319c1efec0b45fb5c1b16830eb0888b3fd1e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3005d43143096321cc857645a9d48ef4ffde8bcf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/30dbb08777b9a611d7d9193c040f382fbd0e7562","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/486876f957456721b5e51af532235db4c6f7bd47","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/54cb2a909996346ac6a8a3beac96c07b3dcba584","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/674aabf554bdaffcf25f145bf32c8b4f510f7916","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/feca5e70fc963b088377b20879e8cd8237c2fd7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98114","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:42.560","lastModified":"2026-10-21T13:21:23.050","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: propagate DACL parsing errors\n\nparse_dacl() silently accepts truncated ACEs and allocation failures,\nallowing set_info_sec() to continue with an incomplete ACL conversion.\n\nReturn parsing and allocation errors to parse_sec_desc() so malformed\nsecurity descriptors are rejected before inode attributes or ACL xattrs\nare updated."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"99ae165acf633b13df34105815110fec332a2cdc","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"461f10a5297e85b7c1cd21838922f2e57b934d2d","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"37952f03d5171eb3a33b2abc2cf6e456d69ff4a1","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"a04dac1f2cffe9533f4260f0659297d805e69194","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"c61dc7b1b4a3234b4aa3965502908a292238805c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/37952f03d5171eb3a33b2abc2cf6e456d69ff4a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/461f10a5297e85b7c1cd21838922f2e57b934d2d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/99ae165acf633b13df34105815110fec332a2cdc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a04dac1f2cffe9533f4260f0659297d805e69194","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c61dc7b1b4a3234b4aa3965502908a292238805c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98115","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:42.667","lastModified":"2026-10-19T10:18:09.537","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: safely drain sessions during logoff\n\nSMB3 multichannel allows requests for one session to run on multiple\nconnections. Wait for all channels bound to a session before freeing\nshared session objects.\n\nA deferred byte-range lock remains counted as a running request and only\nwakes when its file closes. Wake blocked locks during the drain without\nunpublishing or modifying their file objects. Synchronous CANCEL requests\nmust invoke their cancellation callback to wake pending operations, while\nCHANGE_NOTIFY completion remains specific to the asynchronous path.\n\nSerialize session teardown with channel registration and previous-session\ncleanup, and use atomic work-state transitions so LOGOFF, CANCEL, and\nconnection teardown invoke cancellation callbacks only once."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/connection.c","fs/smb/server/mgmt/user_session.c","fs/smb/server/mgmt/user_session.h","fs/smb/server/smb2pdu.c","fs/smb/server/vfs_cache.c","fs/smb/server/vfs_cache.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"76e98a158b207771a6c9a0de0a60522a446a3447","lessThan":"a7e6df0bb92642bee4431b2b85c69ada1e463b21","versionType":"git","status":"affected"},{"version":"76e98a158b207771a6c9a0de0a60522a446a3447","lessThan":"d12168084c8c1b6d883c8eca5853929ac5136a9e","versionType":"git","status":"affected"},{"version":"118fd997612d1efc94a86c307c6c6d659ebe29fc","versionType":"git","status":"affected"},{"version":"c1e55020534c4aafbc38d8f5c4583ff30755ac18","versionType":"git","status":"affected"},{"version":"6.6.48","lessThan":"6.7","versionType":"semver","status":"affected"},{"version":"6.10.7","lessThan":"6.11","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/connection.c","fs/smb/server/mgmt/user_session.c","fs/smb/server/mgmt/user_session.h","fs/smb/server/smb2pdu.c","fs/smb/server/vfs_cache.c","fs/smb/server/vfs_cache.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.48","versionEndExcluding":"6.7","matchCriteriaId":"72C40D03-D807-412F-8A03-2556A2D70DC5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10.7","versionEndExcluding":"6.11","matchCriteriaId":"48B1FCEA-70A6-45BD-A39B-9184638703FB"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11.1","versionEndExcluding":"7.2.7","matchCriteriaId":"E0CA0ED9-385D-45EA-A7C7-A31BCB9103B5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:-:*:*:*:*:*:*","matchCriteriaId":"4770BA57-3F3F-493B-8608-EC3B25254949"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*","matchCriteriaId":"B8383ABF-1457-401F-9B61-EE50F4C61F4F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*","matchCriteriaId":"B77A9280-37E6-49AD-B559-5B23A3B1DC3D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*","matchCriteriaId":"DE5298B3-04B4-4F3E-B186-01A58B5C75A6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/a7e6df0bb92642bee4431b2b85c69ada1e463b21","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d12168084c8c1b6d883c8eca5853929ac5136a9e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98116","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:42.780","lastModified":"2026-10-19T10:18:09.733","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF\n\nsnd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation\nwith an mmap_count check performed under the PCM stream lock, but the\nlock is released long before the buffer is actually freed:\nsnd_pcm_sync_stop(), constraint refinement and do_free_pages() all\nhappen in between.  snd_pcm_mmap_data(), on the other hand, takes no\nlock at all: it validates against the old buffer's state and\ndma_bytes, remaps its pages into the VMA, and only then increments\nmmap_count.\n\nA concurrent mmap() can therefore slip in between the check and the\nfree.  remap_pfn_range() installs writable PTEs for the old buffer's\npages without taking page references, and the subsequent\ndo_free_pages() returns those pages to the page allocator while the\nVMA still maps them.  This leaves a stale, writable mapping of freed\npages: a page-level use-after-free that can be leveraged for local\nprivilege escalation.\n\nMake snd_pcm_mmap_data() participate in the buffer-access scheme\nintroduced for hw_params/hw_free: acquire runtime->buffer_accessing\nbefore validating and remapping, and release it afterwards.  Buffer\nreallocation already fails with -EBUSY while accessors are active,\nand the mmap side now fails with -EBUSY while a reallocation is in\nprogress, so the validate/remap sequence and the check/free sequence\ncan no longer interleave.\n\nA reproducer that turns this race into a stale writable mapping of\nthe freed DMA buffer pages is available on request."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/core/pcm_native.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"33061d0fba51d2bf70a2ef9645f703c33fe8e438","lessThan":"e6cdd2a0470d64073349a970dc1691433804b271","versionType":"git","status":"affected"},{"version":"92ee3c60ec9fe64404dc035e7c41277d74aa26cb","lessThan":"9857a75714bb5df4781e4d8b1a1753b1e17bf07a","versionType":"git","status":"affected"},{"version":"92ee3c60ec9fe64404dc035e7c41277d74aa26cb","lessThan":"cbadf2575d25e7dcc0d4da2717817ae569fbc99b","versionType":"git","status":"affected"},{"version":"92ee3c60ec9fe64404dc035e7c41277d74aa26cb","lessThan":"cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5","versionType":"git","status":"affected"},{"version":"92ee3c60ec9fe64404dc035e7c41277d74aa26cb","lessThan":"fd137bf8149bc6460f9b7b1fc292025da04cb9ee","versionType":"git","status":"affected"},{"version":"92ee3c60ec9fe64404dc035e7c41277d74aa26cb","lessThan":"8c1882dfee8f404d118020664b73eb4592172226","versionType":"git","status":"affected"},{"version":"92ee3c60ec9fe64404dc035e7c41277d74aa26cb","lessThan":"9b110a9dcecc59516c77cb3c0caf1f492f75df2d","versionType":"git","status":"affected"},{"version":"a42aa926843acca96c0dfbde2e835b8137f2f092","versionType":"git","status":"affected"},{"version":"9cb6c40a6ebe4a0cfc9d6a181958211682cffea9","versionType":"git","status":"affected"},{"version":"fbeb492694ce0441053de57699e1e2b7bc148a69","versionType":"git","status":"affected"},{"version":"0f6947f5f5208f6ebd4d76a82a4757e2839a23f8","versionType":"git","status":"affected"},{"version":"0090c13cbbdffd7da079ac56f80373a9a1be0bf8","versionType":"git","status":"affected"},{"version":"1bbf82d9f961414d6c76a08f7f843ea068e0ab7b","versionType":"git","status":"affected"},{"version":"5.15.32","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"4.14.279","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.243","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.193","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.10.109","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.16.18","lessThan":"5.17","versionType":"semver","status":"affected"},{"version":"5.17.1","lessThan":"5.18","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/core/pcm_native.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/8c1882dfee8f404d118020664b73eb4592172226","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9857a75714bb5df4781e4d8b1a1753b1e17bf07a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b110a9dcecc59516c77cb3c0caf1f492f75df2d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cbadf2575d25e7dcc0d4da2717817ae569fbc99b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6cdd2a0470d64073349a970dc1691433804b271","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd137bf8149bc6460f9b7b1fc292025da04cb9ee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98117","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:42.920","lastModified":"2026-10-19T10:18:10.010","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: Fix potential UAF/KASAN warning\n\nCurrently, trace_cachefiles_coherency() is being passed a pointer to a\n__be64 lain over the coherency data in struct cachefiles_xattr so that it\ncan display the first 8 bytes.  However, the data is of variable length and\ncould even be 0 bytes.  This could lead to a UAF or KASAN warning.\n\nFix this by making sure the buffer has room for at least 8 bytes and that\nthose 8 bytes are pre-cleared.\n\nFurther, those bytes are not 8-byte aligned, so fix the tracepoint to\nextract the data as four 2-byte words (they are 2-byte aligned) and\nreassemble the __be64.  The compiler will convert this into a single 8-byte\nload where the CPU supports it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/cachefiles/xattr.c","include/trace/events/cachefiles.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"229105e5cfd9832a9ef1368c96e0098ec3a5fbf0","lessThan":"68d459e6e609c31f96a203dd6eec60c634f155e1","versionType":"git","status":"affected"},{"version":"229105e5cfd9832a9ef1368c96e0098ec3a5fbf0","lessThan":"93488ea378b4427598cace558236c110515d743b","versionType":"git","status":"affected"},{"version":"229105e5cfd9832a9ef1368c96e0098ec3a5fbf0","lessThan":"a67632c8c2688d6e0091529bcefe54bc5ee80e9b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/cachefiles/xattr.c","include/trace/events/cachefiles.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/68d459e6e609c31f96a203dd6eec60c634f155e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/93488ea378b4427598cace558236c110515d743b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a67632c8c2688d6e0091529bcefe54bc5ee80e9b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98118","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:43.030","lastModified":"2026-10-19T10:18:10.153","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix readahead synchronisation issues by loading all folios upfront\n\nThere are some synchronisation issues that derive from the app thread\nadding more folios to the rolling buffer whilst the collector thread is\nlooking at them or trying to clear them, such as determining the setting of\nfront_folio_order when the next folio hasn't been added yet,\n\nThe reason for the rolling buffer approach is that loading the buffer\nupfront and then dropping all the refs just acquired is quite a slow\noperation, and loading progressively allows some of the cost to be deferred\nuntil after at least some of the I/O is started.\n\nInstead, a better way is to load all the folios into the rolling buffer\nupfront - and then drop the refs later, once the I/O is in progress.  (Even\nbetter would be for the refs not to be there at all.)\n\nFix this by changing the rolling buffer loader to load all the folios\nselected by the VM for readahead upfront into the folio queue.  The folio\nqueue is allocated a batch worth at a time as we don't know how many folios\nare involved (the readahead_control struct, alas, has a page count, not a\nfolio count).\n\nThe folio refs acquired from readahead are then dropped in bulk once the\nfirst subrequest is dispatched as it's quite a slow operation.  The\ncollector waits for NETFS_RREQ_NEED_PUT_RA_REFS to be cleared so that it\ndoesn't unlock folios before the xarray has been scanned for them.\n\nThis simplifies the buffer handling later and isn't noticeably slower as\nthe xarray doesn't need to be modified and the folios are all already\npre-locked."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/netfs/buffered_read.c","fs/netfs/internal.h","fs/netfs/misc.c","fs/netfs/read_collect.c","fs/netfs/read_retry.c","fs/netfs/rolling_buffer.c","include/linux/netfs.h","include/linux/rolling_buffer.h","include/trace/events/netfs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ee4cdf7ba857a894ad1650d6ab77669cbbfa329e","lessThan":"8c9b33945712074a85d3bdacbca036ba6b3d92c6","versionType":"git","status":"affected"},{"version":"ee4cdf7ba857a894ad1650d6ab77669cbbfa329e","lessThan":"fed0b33e6c584986ba70018ec9f9787a98216e64","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/netfs/buffered_read.c","fs/netfs/internal.h","fs/netfs/misc.c","fs/netfs/read_collect.c","fs/netfs/read_retry.c","fs/netfs/rolling_buffer.c","include/linux/netfs.h","include/linux/rolling_buffer.h","include/trace/events/netfs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/8c9b33945712074a85d3bdacbca036ba6b3d92c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fed0b33e6c584986ba70018ec9f9787a98216e64","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98119","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:43.140","lastModified":"2026-10-19T10:18:10.300","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: break unbuffered write when netfs_alloc_subrequest() fails\n\nsyzbot reported a null-ptr-deref below [1] following a fault injection in\nnetfs_alloc_subrequest(). [0]\n\nWhen netfs_alloc_subrequest() fails, subreq is NULL.\nLater, netfs_prepare_write() tries to initialize members of\nsubreq(e.g., source), the issue in [1] is triggered.\n\nLet's handle the error of netfs_prepare_write() properly.\n\n[0]\nFAULT_INJECTION: forcing a failure.\nname failslab, interval 1, probability 0, space 0, times 0\nCall Trace:\n netfs_alloc_subrequest+0x116/0x3f0\n netfs_prepare_write+0x76/0x7b0\n netfs_unbuffered_write+0x75c/0x2020\n netfs_unbuffered_write_iter_locked+0x7d6/0xa80\n netfs_unbuffered_write_iter+0x442/0x720\n v9fs_file_write_iter+0xbf/0x100\n vfs_write+0x6ac/0x1050\n\n[1]\nKASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af]\nRIP: 0010:netfs_prepare_write+0xbc/0x7b0 fs/netfs/write_issue.c:173\nCall Trace:\n netfs_unbuffered_write+0x75c/0x2020 fs/netfs/direct_write.c:111\n netfs_unbuffered_write_iter_locked+0x7d6/0xa80 fs/netfs/direct_write.c:290\n netfs_unbuffered_write_iter+0x442/0x720 fs/netfs/direct_write.c:382\n v9fs_file_write_iter+0xbf/0x100 fs/9p/vfs_file.c:409\n new_sync_write fs/read_write.c:595 [inline]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/netfs/direct_write.c","fs/netfs/write_issue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"288ace2f57c9d06dd2e42bd80d03747d879a4068","lessThan":"cf6f93b8b06acf57de62dacbe71a3b99c68656a7","versionType":"git","status":"affected"},{"version":"288ace2f57c9d06dd2e42bd80d03747d879a4068","lessThan":"19f246c795e940dc5f11cd5bc0cb1e81bc7b7090","versionType":"git","status":"affected"},{"version":"288ace2f57c9d06dd2e42bd80d03747d879a4068","lessThan":"8fb45a934661419c04a44d4cfea1e0df7dcf2805","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/netfs/direct_write.c","fs/netfs/write_issue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/19f246c795e940dc5f11cd5bc0cb1e81bc7b7090","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8fb45a934661419c04a44d4cfea1e0df7dcf2805","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf6f93b8b06acf57de62dacbe71a3b99c68656a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98120","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:43.253","lastModified":"2026-10-19T10:18:10.450","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix subreq ref leak\n\nFix a subrequest ref leak in netfs_unbuffered_write() in the event that\nsubreq->io_iter ends up zero length during preparation."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/netfs/direct_write.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"72d08d2839649d1c5efbe375751f4473fa4486af","lessThan":"ebefb12122d1319257ecac01c1a928f78007716a","versionType":"git","status":"affected"},{"version":"a0b4c7a49137ed21279f354eb59f49ddae8dffc2","lessThan":"0a573f4283a965a5e8716f621aec404cb4575328","versionType":"git","status":"affected"},{"version":"a0b4c7a49137ed21279f354eb59f49ddae8dffc2","lessThan":"3c30087e27598d9d359763e8be9bd3017fe08348","versionType":"git","status":"affected"},{"version":"0c29f6d63122a0168d67cb8ecde5b4cf7fe4acb0","versionType":"git","status":"affected"},{"version":"6.18.17","lessThan":"6.18.53","versionType":"semver","status":"affected"},{"version":"6.19.7","lessThan":"6.20","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/netfs/direct_write.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0a573f4283a965a5e8716f621aec404cb4575328","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3c30087e27598d9d359763e8be9bd3017fe08348","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ebefb12122d1319257ecac01c1a928f78007716a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98121","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:43.360","lastModified":"2026-10-22T17:23:28.030","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: msc313e: Fix NULL pointer dereference in PM callbacks\n\nmsc313e_wdt_probe() doesn't set the driver data for the platform device.\nAs a result, dev_get_drvdata() in msc313e_wdt_suspend() and\nmsc313e_wdt_resume() will return NULL, leading to a NULL pointer\ndereference afterward.\n\nSet the platform device driver data in msc313e_wdt_probe()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/watchdog/msc313e_wdt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"960251cc4a413d8f1eef2a2c6aca41073b57ce16","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"afc3ea51e479289a23c642cc8bade67b94225ed9","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"a135415be56839e555e0bcdd5ffb8d2f5f947bd7","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"b02f902fe4b59d65f74a25c4523a75453bd3f808","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"744b25040d8206f7925b8ba0be5edf93fa4bf81e","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"6495dc16e635356fd2b7535dcbf9b6779de4e753","versionType":"git","status":"affected"},{"version":"e9800b7994642a794afd4894f072541c14277ce8","lessThan":"e3eceb76515910746e6268c4e4ac1c07516ebd7b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/watchdog/msc313e_wdt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-476"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"5.15.222","matchCriteriaId":"D88C66F1-FBE4-4A79-BC61-1C53ABB151A5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.189","matchCriteriaId":"FE14E0F2-AE30-4319-B6E7-5D8B82530FD6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.158","matchCriteriaId":"575D98F4-AE0C-4D1F-91BC-CD1C75F0FED0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*","matchCriteriaId":"14FD7B9A-4946-4511-8E63-6E13870CD4A8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/6495dc16e635356fd2b7535dcbf9b6779de4e753","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/744b25040d8206f7925b8ba0be5edf93fa4bf81e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/960251cc4a413d8f1eef2a2c6aca41073b57ce16","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/a135415be56839e555e0bcdd5ffb8d2f5f947bd7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/afc3ea51e479289a23c642cc8bade67b94225ed9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/b02f902fe4b59d65f74a25c4523a75453bd3f808","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e3eceb76515910746e6268c4e4ac1c07516ebd7b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98122","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:43.470","lastModified":"2026-10-22T17:19:22.093","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()\n\nvxlan_mdb_is_valid_source(), which validates MDBE_ATTR_SOURCE and every\nMDBE_ATTR_SRC_LIST member, accepts the all-zeros address.\n\nA source list is only accepted on a (*, G) entry, whose source is the\nall-zeros address, and for each member of the list an (S, G) entry is\nderived from it by substituting the source. Entries are keyed by a plain\nmemcmp() of struct vxlan_mdb_entry_key, so if MDBE_ATTR_SOURCE is present\nand holds the all-zeros address and the source list holds it as well, the\nderived (S, G) key is byte-identical to the (*, G) key and resolves to the\nsame entry. Omitting MDBE_ATTR_SOURCE is not equivalent, as the key is\nthen left with a zero address family.\n\nvxlan_mdb_remote_src_del() removes the forwarding entry of a source before\nfreeing the source entry:\n\n\tvxlan_mdb_remote_src_fwd_del(vxlan, group, remote, &ent->addr);\n\tvxlan_mdb_remote_src_entry_del(ent);\n\nWith the keys aliased, the first call deletes the remote of the entry that\nowns 'ent' instead of a separate (S, G) entry, and frees 'ent'. The second\ncall then runs on the freed entry, and its hlist_del() reads ->pprev and\n->next out of it and writes through them.\n\nAdding the (*, G) entry with NLM_F_REPLACE and no source list marks the\nall-zeros source for deletion and reaches this from the sweep at the end\nof vxlan_mdb_remote_srcs_replace().\n\n  BUG: KASAN: slab-use-after-free in __vxlan_mdb_add+0x1cd/0xd70\n  Read of size 8 at addr ffff888102852500 by task poc/84\n   __vxlan_mdb_add+0x1cd/0xd70\n   vxlan_mdb_add+0xc0/0x140\n   rtnl_mdb_add+0x157/0x2a0\n   rtnetlink_rcv_msg+0x207/0x5a0\n  Allocated by task 84:\n   __kmalloc_cache_noprof+0x153/0x360\n   vxlan_mdb_remote_srcs_add+0x2eb/0x440\n   __vxlan_mdb_add+0x803/0xd70\n  Freed by task 84:\n   kfree+0x14c/0x3b0\n   vxlan_mdb_remote_del+0x129/0x1a0\n   __vxlan_mdb_del+0x4f/0xe0\n   vxlan_mdb_remote_src_fwd_del.isra.0+0x162/0x1b0\n   __vxlan_mdb_add+0x1c5/0xd70\n\nThe MDB operations are netns-scoped, so an unprivileged user can perform\nthem in a new user and network namespace.\n\nReject the all-zeros address in vxlan_mdb_is_valid_source(), which covers\nboth call sites. A (*, G) entry is expressed by omitting the source, so\nnothing legitimate is refused.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/vxlan/vxlan_mdb.c","tools/testing/selftests/net/test_vxlan_mdb.sh"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a3a48de5eade770e911d35291217bdd69ce04ef1","lessThan":"069d5527bb0f229e528fa88c6b72f15060c373f2","versionType":"git","status":"affected"},{"version":"a3a48de5eade770e911d35291217bdd69ce04ef1","lessThan":"e12c903fd13c6261b98ca18d8f70ac26e739e2f8","versionType":"git","status":"affected"},{"version":"a3a48de5eade770e911d35291217bdd69ce04ef1","lessThan":"74e2a56c82209b0335b53e25f19f9b0590e2483d","versionType":"git","status":"affected"},{"version":"a3a48de5eade770e911d35291217bdd69ce04ef1","lessThan":"71203a41d6fa2fa0ea2f3a7541987958bd3694fd","versionType":"git","status":"affected"},{"version":"a3a48de5eade770e911d35291217bdd69ce04ef1","lessThan":"4aa61c88b4e292e10abdfd791334b8272108d68a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/vxlan/vxlan_mdb.c","tools/testing/selftests/net/test_vxlan_mdb.sh"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.6.158","matchCriteriaId":"0E70134D-9B4B-43A0-B5C8-9DCEDD74AB69"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/069d5527bb0f229e528fa88c6b72f15060c373f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/4aa61c88b4e292e10abdfd791334b8272108d68a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/71203a41d6fa2fa0ea2f3a7541987958bd3694fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/74e2a56c82209b0335b53e25f19f9b0590e2483d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e12c903fd13c6261b98ca18d8f70ac26e739e2f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98123","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:43.600","lastModified":"2026-10-22T16:46:55.180","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration\n\nsctp_verify_asconf() walks ASCONF-ACK parameters with\nsctp_walk_params(), which advances by SCTP_PAD4(length), while the\nconsumer sctp_get_asconf_response() iterates the same parameters\nadvancing by the raw length, without padding. A single odd-length\nparameter desynchronises the two walks and makes the consumer\ninterpret attacker-controlled bytes at a misaligned offset.\n\nWhen those bytes yield a length of zero, the while loop over\nasconf_ack_len makes no progress, spinning forever in softirq\ncontext, and the watchdog reports a soft lockup. All reads stay\nwithin the received skb, so the lockup is a pure remote denial of\nservice. A remote peer can trigger it with a crafted ASCONF-ACK on\nan ADD-IP enabled association with an outstanding ASCONF (RFC 5061\nsection 4.1.2 requires the chunk to be authenticated, but the\npredefined empty key id 0 allows the peer to compute the same\nassociation HMAC from publicly exchanged parameters, so the gate\ndoes not help).\n\nThe SCTP_PARAM_ERR_CAUSE case of sctp_verify_asconf() also performs\nno length check, letting a parameter without a complete error\nheader reach the consumer, which reads errhdr.cause past the end of\nthe parameter, an out-of-bounds read.\n\nReject SCTP_PARAM_ERR_CAUSE parameters shorter than\nsizeof(struct sctp_addip_param) + sizeof(struct sctp_errhdr) at the\nverifier, and advance the consumer iterator with the same padding\nrule as the verifier to keep the two walks in lockstep. The verifier\nchange guarantees a complete error header in every ERR_CAUSE\nparameter the consumer can see, so the consumer's asconf_ack_len\ncheck is dropped and it returns err_param->cause directly. The\nconsumer padding fix is still required because odd lengths remain\nvalid for SCTP_PARAM_ERR_CAUSE per RFC 5061.\n\nThe issue was found by ZeroHive, a vulnerability hunting agent at\nTencent Yunding Lab."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sctp/sm_make_chunk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"ba54cad229977f4fae6355dbdaf117088414fdd0","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7d8e7ab6a0665888beee91f7ad77ac805963c4fd","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5fbc6a778d5fce7628821236972596acb18e1065","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4548d843e7b29f6d150d8caae4e64015fa226b0c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"abf59d7f6fff23227256e8199aca5ade45758f8b","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3be02999ab9131a4b96eb1eda4ca48b1cea80f03","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7ba84e2971d208a2d6413a334ec28a8a32cdce0f","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2cb0b0b1ed69430bf73740377ea0a1c44c50db63","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sctp/sm_make_chunk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-667"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12.1","versionEndExcluding":"5.10.271","matchCriteriaId":"1CF76AFC-4CEB-441C-82C1-ED513250202C"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.222","matchCriteriaId":"A5EFABC8-89EB-4EE7-9EE1-A9A30E730AFC"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.189","matchCriteriaId":"FE14E0F2-AE30-4319-B6E7-5D8B82530FD6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.158","matchCriteriaId":"575D98F4-AE0C-4D1F-91BC-CD1C75F0FED0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/2cb0b0b1ed69430bf73740377ea0a1c44c50db63","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/3be02999ab9131a4b96eb1eda4ca48b1cea80f03","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/4548d843e7b29f6d150d8caae4e64015fa226b0c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/5fbc6a778d5fce7628821236972596acb18e1065","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/7ba84e2971d208a2d6413a334ec28a8a32cdce0f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/7d8e7ab6a0665888beee91f7ad77ac805963c4fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/abf59d7f6fff23227256e8199aca5ade45758f8b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/ba54cad229977f4fae6355dbdaf117088414fdd0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98124","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:43.720","lastModified":"2026-10-22T16:38:53.723","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: invalidate fscache for fallocate range operations\n\nsmb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and\nsmb3_collapse_range() modify file contents through server-side range\noperations. These operations discard the affected page cache, but leave\nthe FS-Cache cookie valid, so a later read may return data cached before\nthe range operation.\n\nFix this by invalidating FS-Cache after outstanding I/O has completed\nand before modifying the file on the server.\n\nRun the following as root on a CIFS mount with fsc enabled and an active\nCacheFiles backend:\n\n        bash -c '\n                MNT=/mnt/cifs\n                FILE=\"$MNT/repro\"\n\n                # Generate four 1 MiB random blocks: [A][B][C][D].\n                dd if=/dev/urandom of=/tmp/src bs=1M count=4 status=none\n\n                # Expected contents after zeroing B: [A][zero][C][D].\n                cp /tmp/src /tmp/expected\n                dd if=/dev/zero of=/tmp/expected bs=1M seek=1 count=1 \\\n                        conv=notrunc status=none\n                cp /tmp/src \"$FILE\"\n\n                # Populate FS-Cache, then discard the page cache.\n                sync\n                echo 1 > /proc/sys/vm/drop_caches\n                cat \"$FILE\" > /dev/null\n                sync\n                echo 1 > /proc/sys/vm/drop_caches\n\n                fallocate --zero-range -o 1M -l 1M \"$FILE\"\n\n                if cmp -s /tmp/expected \"$FILE\"; then\n                        echo \"readback: OK\"\n                else\n                        echo \"readback: STALE DATA\"\n                fi\n        '\n\nBefore this change, the readback differs from /tmp/expected:\n\n        readback: STALE DATA\n\nAfter this change, it matches:\n\n        readback: OK"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"31742c5a331766bc7df6b0d525df00c6cd20d5a6","lessThan":"cc7202a51b8777a757bda9dcfbf339f828c6a130","versionType":"git","status":"affected"},{"version":"31742c5a331766bc7df6b0d525df00c6cd20d5a6","lessThan":"dd8b1e808f5c19479e6ed47e2f88a1fd46f8b0e5","versionType":"git","status":"affected"},{"version":"31742c5a331766bc7df6b0d525df00c6cd20d5a6","lessThan":"93c6e5a8d7c5071d586c1411596d5db5faad22b2","versionType":"git","status":"affected"},{"version":"31742c5a331766bc7df6b0d525df00c6cd20d5a6","lessThan":"448ba0ae65ca61064183564d2983c9aa59bd6ba7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.17","status":"affected"},{"version":"0","lessThan":"3.17","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-672"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.17.1","versionEndExcluding":"6.6.160","matchCriteriaId":"438C480C-978E-4F8C-A37D-7CB29AE32E61"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:-:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.114","matchCriteriaId":"7DD957C0-0777-4304-9BCA-7E8429CBE3D3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"7.2.7","matchCriteriaId":"BACEDE75-270F-419E-A22D-025914C6BA15"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:3.17:-:*:*:*:*:*:*","matchCriteriaId":"3A351B03-87A0-405B-8A9B-488E173E1E3B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:3.17:rc2:*:*:*:*:*:*","matchCriteriaId":"434E8752-0D8B-42E1-8B8F-23C409AB442C"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:3.17:rc3:*:*:*:*:*:*","matchCriteriaId":"D64AD3CD-8D3C-4749-9042-969F524DCB68"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:3.17:rc4:*:*:*:*:*:*","matchCriteriaId":"4B4E29E3-9F10-43B1-A349-1F7484F6015A"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:3.17:rc5:*:*:*:*:*:*","matchCriteriaId":"4223286C-F679-4FEC-B144-1C3B942BD506"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:3.17:rc6:*:*:*:*:*:*","matchCriteriaId":"C889AAA8-186E-433F-A31D-FF09221E1EBC"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:3.17:rc7:*:*:*:*:*:*","matchCriteriaId":"80BC78EE-50D8-4561-A6A6-A370E72F215B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*","matchCriteriaId":"5A3F9505-6B98-4269-8B81-127E55A1BF00"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/448ba0ae65ca61064183564d2983c9aa59bd6ba7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/93c6e5a8d7c5071d586c1411596d5db5faad22b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/cc7202a51b8777a757bda9dcfbf339f828c6a130","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/dd8b1e808f5c19479e6ed47e2f88a1fd46f8b0e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98125","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:43.827","lastModified":"2026-10-22T16:20:13.427","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: fix stale page cache in insert/collapse range\n\nsmb3_insert_range() and smb3_collapse_range() use\ntruncate_pagecache_range() to invalidate the affected page cache.\nHowever, if off or old_eof is not page-aligned, the boundary pages are\nonly partially zeroed and remain uptodate. As a result, the client may\nreturn stale data after a successful insert/collapse range operation.\n\nFor example, with 4K pages:\n\n    page 0          page 1          page 2\n    0------4K       4K------8K      8K------12K\n       ^                                ^\n    off=2K                       old_eof=10K\n\nPage 1 is removed from the page cache, while the boundary pages are\nonly partially zeroed. After COPYCHUNK moves the data on the server,\nthese cached pages may still return stale data.\n\nThis can be reproduced on a CIFS mount:\n\n    bash -c '\n            FILE=/mnt/scratch/repro\n\n            # Use a 6 KiB file so EOF is not page-aligned.\n            dd if=/dev/urandom of=/tmp/src bs=1K count=6 status=none\n\n            # Expected: a 4 KiB hole followed by the original data.\n            rm -f /tmp/expected\n            truncate -s 4K /tmp/expected\n            cat /tmp/src >> /tmp/expected\n\n            cp /tmp/src \"$FILE\"\n\n            # Prime the page cache before moving data on the server.\n            cat \"$FILE\" > /dev/null\n\n            fallocate --insert-range -o 0 -l 4K \"$FILE\"\n\n            if cmp -s /tmp/expected \"$FILE\"; then\n                    echo \"readback: OK\"\n            else\n                    echo \"readback: STALE DATA\"\n            fi\n    '\n\nFix this by writing back dirty data and discarding the page cache from\nthe start of the page containing off to EOF before moving data on the\nserver."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fa30a81f255a56cccd89552cd6ce7ea6e8d8acc4","lessThan":"52dd721b3de57e41261e08485b2bc62b22b80ebe","versionType":"git","status":"affected"},{"version":"fa30a81f255a56cccd89552cd6ce7ea6e8d8acc4","lessThan":"76222e76d08fbae4092ee9da84ded2b4c24ee598","versionType":"git","status":"affected"},{"version":"fa30a81f255a56cccd89552cd6ce7ea6e8d8acc4","lessThan":"01261a6fa48b62f5ead8e88aaca1e27cb9ab9032","versionType":"git","status":"affected"},{"version":"49523a4732204bdacbf3941a016503ddb4ddb3b9","versionType":"git","status":"affected"},{"version":"0cdde8460c304283d4ebe3f767a70215d1ab9d4e","versionType":"git","status":"affected"},{"version":"5.19.12","lessThan":"5.20","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-669"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19.12","versionEndExcluding":"6.0","matchCriteriaId":"B9F7B410-020B-4CF1-96DA-7CFE097E00D3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.6.160","matchCriteriaId":"DB94CEE5-D8B8-4B06-A3A8-0A9C090F5154"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"7.2.7","matchCriteriaId":"CCD47D7A-463E-4E28-8B49-88D3A1E8406B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.0:-:*:*:*:*:*:*","matchCriteriaId":"7BE551E5-89CF-47A8-9B26-03CE727FBA37"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.0:rc4:*:*:*:*:*:*","matchCriteriaId":"F8446E87-F5F6-41CA-8201-BAE0F0CA6DD9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.0:rc5:*:*:*:*:*:*","matchCriteriaId":"8E5FB72F-67CE-43CC-83FE-541604D98182"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.0:rc6:*:*:*:*:*:*","matchCriteriaId":"3A0A7397-F5F8-4753-82DC-9A11288E696D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.0:rc7:*:*:*:*:*:*","matchCriteriaId":"E6DE049A-ABA8-41DD-988C-8C088358EE9B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/01261a6fa48b62f5ead8e88aaca1e27cb9ab9032","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/52dd721b3de57e41261e08485b2bc62b22b80ebe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/76222e76d08fbae4092ee9da84ded2b4c24ee598","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98126","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:43.940","lastModified":"2026-10-22T16:02:09.817","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: validate new EOF for zero range\n\nWhen FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE,\nsmb3_zero_range() may extend EOF without checking RLIMIT_FSIZE, allowing\nthe file to grow beyond the caller's file-size limit.\n\nFix this by calling inode_newsize_ok() before sending the zero-range\nrequest when the operation would extend EOF.\n\nReproducer, using a file on a CIFS mount:\n\n\tbash -c '\n\t        FILE=/mnt/cifs/repro\n\n\t        trap \"\" SIGXFSZ\n\t        ulimit -f 3072\n\n\t        truncate -s 2M \"$FILE\"\n\t        fallocate --zero-range -o 0 -l 4M \"$FILE\"\n\t        echo \"fallocate rc=$?\"\n\t        stat -c \"file size=%s\" \"$FILE\"\n\t'\n\nBefore this change, the operation succeeds despite the 3 MiB limit:\n\n\tfallocate rc=0\n\tfile size=4194304\n\nAfter this change, fallocate fails and leaves the file at 2 MiB."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"72c419d9b073628d3b5b0b2fc787b724f1a8c726","lessThan":"5fbd8848f2e25c8163896ec52863df2305a3bb63","versionType":"git","status":"affected"},{"version":"72c419d9b073628d3b5b0b2fc787b724f1a8c726","lessThan":"3673f057b64abfa957e8ae84448db69369a5091a","versionType":"git","status":"affected"},{"version":"72c419d9b073628d3b5b0b2fc787b724f1a8c726","lessThan":"06a4f9049cb6dc319bceec2dc813ba89add8b828","versionType":"git","status":"affected"},{"version":"72c419d9b073628d3b5b0b2fc787b724f1a8c726","lessThan":"f320ca20c273a26cd779bdb2b2e4b076a95c76f6","versionType":"git","status":"affected"},{"version":"72c419d9b073628d3b5b0b2fc787b724f1a8c726","lessThan":"88972e35750792e717af287dc71f42a03b5cbce4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.1","status":"affected"},{"version":"0","lessThan":"5.1","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.6.160","matchCriteriaId":"C8BA8F59-66E8-4D4D-8ED2-10000122964B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/06a4f9049cb6dc319bceec2dc813ba89add8b828","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/3673f057b64abfa957e8ae84448db69369a5091a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/5fbd8848f2e25c8163896ec52863df2305a3bb63","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/88972e35750792e717af287dc71f42a03b5cbce4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f320ca20c273a26cd779bdb2b2e4b076a95c76f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98127","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:44.050","lastModified":"2026-10-22T15:55:04.660","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: validate new EOF for insert range\n\nsmb3_insert_range() does not check if the new file size\n(i_size + len) is valid. This allows FALLOC_FL_INSERT_RANGE to bypass\nRLIMIT_FSIZE, exceed s_maxbytes, or produce a size outside the loff_t\nrange.\n\nUse check_add_overflow() to calculate the new EOF. Validate it with\ninode_newsize_ok() before modifying the file.\n\nReproducer, using a file on a CIFS mount:\n\n\tbash -c '\n\t\tFILE=/mnt/cifs/repro\n\n\t\ttrap \"\" SIGXFSZ\n\t\tulimit -f 3072\t\t# RLIMIT_FSIZE = 3 MiB\n\n\t\t# A regular write is stopped at 3 MiB.\n\t\tdd if=/dev/zero of=\"$FILE\" bs=1M count=4 status=none\n\t\tstat -c \"size after write: %s\" \"$FILE\"\n\n\t\t# Insert 2 MiB into a 2 MiB file.\n\t\ttruncate -s 2M \"$FILE\"\n\t\tfallocate -i -o 0 -l 2M \"$FILE\"\n\t\tstat -c \"size after insert: %s\" \"$FILE\"\n\t'\n\nBefore this change, the regular write stops at the 3 MiB limit, but\ninsert range grows the file to 4 MiB:\n\n\tdd: error writing '/mnt/cifs/repro': File too large\n\tsize after write: 3145728\n\tsize after insert: 4194304\n\nAfter this change, insert range also fails at the limit and leaves the\n2 MiB file unchanged:\n\n\tdd: error writing '/mnt/cifs/repro': File too large\n\tsize after write: 3145728\n\tfallocate: fallocate failed: File too large\n\tsize after insert: 2097152"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7fe6fe95b936084dce6eedcc2cccadf96eafae73","lessThan":"b7f2e33d9f5db7b8e6e5e0a5a93d0c5e31870356","versionType":"git","status":"affected"},{"version":"7fe6fe95b936084dce6eedcc2cccadf96eafae73","lessThan":"7c2c69045aa76ccaa7f16f1478eb312130ce4951","versionType":"git","status":"affected"},{"version":"7fe6fe95b936084dce6eedcc2cccadf96eafae73","lessThan":"bc7602b9082ef195d913c4c16fa9853dd262333e","versionType":"git","status":"affected"},{"version":"7fe6fe95b936084dce6eedcc2cccadf96eafae73","lessThan":"f8cbfe3a3fcee7d991fd223f660f3e5df13221cf","versionType":"git","status":"affected"},{"version":"7fe6fe95b936084dce6eedcc2cccadf96eafae73","lessThan":"1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.6.160","matchCriteriaId":"C3EC3EBA-ACF8-4116-A6A8-4C27AA6014E2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/7c2c69045aa76ccaa7f16f1478eb312130ce4951","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/b7f2e33d9f5db7b8e6e5e0a5a93d0c5e31870356","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/bc7602b9082ef195d913c4c16fa9853dd262333e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f8cbfe3a3fcee7d991fd223f660f3e5df13221cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98128","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:44.163","lastModified":"2026-10-22T15:18:03.967","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()\n\nmpi3mr_get_tgtdev_by_addr() increments the target device kref when it\nreturns a device. If a subsequent error triggers a goto out_fail after\nthe tgtdev reference is acquired, the reference is never released\nbecause the out_fail path does not call mpi3mr_tgtdev_put(). This\nprevents the target device structure from ever being freed.\n\nAdd a tgtdev put in the out_fail path, guarded by a NULL check since\ntgtdev is only acquired for SAS_END_DEVICE types and the same cleanup\npath is shared by earlier error cases where tgtdev is still NULL."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/mpi3mr/mpi3mr_transport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e22bae30667a7e74ed057e00fb6e8c79e0738de3","lessThan":"60a9aaac07f6470b252c4de40e7d8a6e25004093","versionType":"git","status":"affected"},{"version":"e22bae30667a7e74ed057e00fb6e8c79e0738de3","lessThan":"58e3d2fbc8c914ed3dce2f7d915b3c4f4a3c76fb","versionType":"git","status":"affected"},{"version":"e22bae30667a7e74ed057e00fb6e8c79e0738de3","lessThan":"040146f81d099006a354b0caacc7f01ca00f257e","versionType":"git","status":"affected"},{"version":"e22bae30667a7e74ed057e00fb6e8c79e0738de3","lessThan":"06a7073b33b8f5cb0ee71e07dc669efffb1c7d58","versionType":"git","status":"affected"},{"version":"e22bae30667a7e74ed057e00fb6e8c79e0738de3","lessThan":"1ccbe8c42009706af79e6629c70d42fc929aef2b","versionType":"git","status":"affected"},{"version":"e22bae30667a7e74ed057e00fb6e8c79e0738de3","lessThan":"419d129f970aaa6567dbac366b0c93784bf9ec97","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/mpi3mr/mpi3mr_transport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-401"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.12.111","matchCriteriaId":"C7A62F3A-1168-46ED-BFB5-F15E128F1375"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/040146f81d099006a354b0caacc7f01ca00f257e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/06a7073b33b8f5cb0ee71e07dc669efffb1c7d58","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/1ccbe8c42009706af79e6629c70d42fc929aef2b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/419d129f970aaa6567dbac366b0c93784bf9ec97","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/58e3d2fbc8c914ed3dce2f7d915b3c4f4a3c76fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/60a9aaac07f6470b252c4de40e7d8a6e25004093","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98129","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:44.270","lastModified":"2026-10-22T15:10:31.867","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()\n\nsas_port_alloc_num() can return NULL on memory allocation failure. The\nreturn value is passed directly to sas_port_add() without a NULL check,\nwhich causes a NULL pointer dereference.\n\nAdditionally, if sas_port_add() fails, the allocated port is not freed\nbefore jumping to out_fail, leaking the sas_port structure. Call\nsas_port_free() to properly release it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/mpi3mr/mpi3mr_transport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e22bae30667a7e74ed057e00fb6e8c79e0738de3","lessThan":"7e3489b5950e7668355762968a7c7f75fe9bc80d","versionType":"git","status":"affected"},{"version":"e22bae30667a7e74ed057e00fb6e8c79e0738de3","lessThan":"c848a1bbe110496eff8dcdf7cfbff66a69edae89","versionType":"git","status":"affected"},{"version":"e22bae30667a7e74ed057e00fb6e8c79e0738de3","lessThan":"5c50137ba11b6e20e7074303dae35ff58d5a0b6f","versionType":"git","status":"affected"},{"version":"e22bae30667a7e74ed057e00fb6e8c79e0738de3","lessThan":"2f69ed909de9e3d46af9db7dd24b9b80dc31b5ec","versionType":"git","status":"affected"},{"version":"e22bae30667a7e74ed057e00fb6e8c79e0738de3","lessThan":"5cb58b052cf09dd8e88d92c1d649b3eea5c95d4d","versionType":"git","status":"affected"},{"version":"e22bae30667a7e74ed057e00fb6e8c79e0738de3","lessThan":"dba9e2181ca5e875f98b8b9b4535cdaab87dcb0d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/mpi3mr/mpi3mr_transport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-476"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.1.189","matchCriteriaId":"A08955FE-5938-4F5B-B6A0-BEA8BA740A26"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.158","matchCriteriaId":"575D98F4-AE0C-4D1F-91BC-CD1C75F0FED0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/2f69ed909de9e3d46af9db7dd24b9b80dc31b5ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/5c50137ba11b6e20e7074303dae35ff58d5a0b6f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/5cb58b052cf09dd8e88d92c1d649b3eea5c95d4d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/7e3489b5950e7668355762968a7c7f75fe9bc80d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/c848a1bbe110496eff8dcdf7cfbff66a69edae89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/dba9e2181ca5e875f98b8b9b4535cdaab87dcb0d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98130","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:44.380","lastModified":"2026-10-22T15:26:06.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix a TOCTOU race in SCTP_CMD_TIMER_START\n\nThe SCTP_CMD_TIMER_START handler checks timer_pending() before calling\ntimer_reduce(). The timer can expire and detach between these operations,\ncausing timer_reduce() to rearm the timer without taking the association\nreference required for the newly armed timer.\n\nThe timer callback later unconditionally drops its association reference,\nwhich can leave the association reference count unbalanced and result in\nuse-after-free during association teardown.\n\nUse the return value of timer_reduce() to determine whether the timer was\nactually armed. Take the association reference only when timer_reduce()\nsuccessfully starts a new timer, closing the race between checking the\ntimer state and rearming it.\n\nThis issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero\nDay Initiative."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sctp/sm_sideeffect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"20a785aa52c82246055a089e55df9dac47d67da1","lessThan":"cbf2df9aac4202f9fb0b361a7fe8c79b29fad92c","versionType":"git","status":"affected"},{"version":"20a785aa52c82246055a089e55df9dac47d67da1","lessThan":"3205a20f837f5b1f009427ac3d9f706bf8a6fbec","versionType":"git","status":"affected"},{"version":"20a785aa52c82246055a089e55df9dac47d67da1","lessThan":"755d70ca845fd9b87c7b338ae6ae832b08cd0005","versionType":"git","status":"affected"},{"version":"20a785aa52c82246055a089e55df9dac47d67da1","lessThan":"09e7f9290d63178f56095d5c18fb9f9470153db5","versionType":"git","status":"affected"},{"version":"20a785aa52c82246055a089e55df9dac47d67da1","lessThan":"e42ba56281ca3ae2dcb3558bebee9a1c9a4831d9","versionType":"git","status":"affected"},{"version":"20a785aa52c82246055a089e55df9dac47d67da1","lessThan":"00b841bac10230c557be6b38efc48508198fe23e","versionType":"git","status":"affected"},{"version":"20a785aa52c82246055a089e55df9dac47d67da1","lessThan":"3d698d1e6c8bc41e3e1707777a016f1bdd07842d","versionType":"git","status":"affected"},{"version":"20a785aa52c82246055a089e55df9dac47d67da1","lessThan":"2188569e7e1b0bc3f3b557dc97ab7a02befc11c8","versionType":"git","status":"affected"},{"version":"9c0a4652f750afe3b4468cbcd9335b244ce2facd","versionType":"git","status":"affected"},{"version":"70989e501fbce502198d82da88358ce453575a05","versionType":"git","status":"affected"},{"version":"085bb270b4b1168c93afb37bbafc881207d15443","versionType":"git","status":"affected"},{"version":"4.19.126","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.44","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.6.16","lessThan":"5.7","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sctp/sm_sideeffect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.126","versionEndExcluding":"4.20","matchCriteriaId":"9232A5F8-171A-4235-B136-95DC2459D811"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.44","versionEndExcluding":"5.5","matchCriteriaId":"8DA34D52-0D71-4B18-9AD6-84CF42AF02BB"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6.16","versionEndExcluding":"5.7","matchCriteriaId":"9018F5D8-6A28-43D2-B2D3-D6015DAA2F4F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7.1","versionEndExcluding":"5.10.271","matchCriteriaId":"79AF7235-5AE2-4DC6-9733-A79D29B888AF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.222","matchCriteriaId":"A5EFABC8-89EB-4EE7-9EE1-A9A30E730AFC"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.189","matchCriteriaId":"FE14E0F2-AE30-4319-B6E7-5D8B82530FD6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.158","matchCriteriaId":"575D98F4-AE0C-4D1F-91BC-CD1C75F0FED0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.111","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:-:*:*:*:*:*:*","matchCriteriaId":"3D23CE42-BDB2-4216-8495-230ABE98FCDD"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:rc7:*:*:*:*:*:*","matchCriteriaId":"9D26AE9C-D49F-4FE9-8A6A-5A7199B7436E"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/00b841bac10230c557be6b38efc48508198fe23e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/09e7f9290d63178f56095d5c18fb9f9470153db5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/2188569e7e1b0bc3f3b557dc97ab7a02befc11c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/3205a20f837f5b1f009427ac3d9f706bf8a6fbec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/3d698d1e6c8bc41e3e1707777a016f1bdd07842d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/755d70ca845fd9b87c7b338ae6ae832b08cd0005","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/cbf2df9aac4202f9fb0b361a7fe8c79b29fad92c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e42ba56281ca3ae2dcb3558bebee9a1c9a4831d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98131","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:44.500","lastModified":"2026-10-21T13:21:23.907","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix dma mapping leak in stmmac_tso_xmit()\n\nIn stmmac_tso_xmit(), if the DMA mapping of an skb fragment fails, the\nframe is dropped but the DMA mappings already created for the linear\npart and for the fragments mapped before the failure are never\nunmapped, leaking DMA mappings.\n\nFix the leak by walking back over the descriptors used by the frame and\nreleasing each of them with stmmac_free_tx_buffer(). Moreover, release\nthe descriptors with stmmac_release_tx_desc() unmapping the DMA buffers."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f748be531d7012c456b97f66091d86b3675c5fef","lessThan":"c5449b635362cb678d29d8f6ab54e65734d891ce","versionType":"git","status":"affected"},{"version":"f748be531d7012c456b97f66091d86b3675c5fef","lessThan":"8a3257f142ae513d0c96d42f97386d4941bcec29","versionType":"git","status":"affected"},{"version":"f748be531d7012c456b97f66091d86b3675c5fef","lessThan":"e85adaac3dc6317cae902372c6849189ec62cf7d","versionType":"git","status":"affected"},{"version":"f748be531d7012c456b97f66091d86b3675c5fef","lessThan":"a5d946466a95621fa2769720d59ea336003aa1a5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-401"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"7.2.7","matchCriteriaId":"3FD17828-FF83-49FD-8B19-7DA480FB617B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/8a3257f142ae513d0c96d42f97386d4941bcec29","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a5d946466a95621fa2769720d59ea336003aa1a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/c5449b635362cb678d29d8f6ab54e65734d891ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e85adaac3dc6317cae902372c6849189ec62cf7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98132","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:44.603","lastModified":"2026-10-19T10:18:12.373","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: don't downgrade half-dead scalar zero spills to STACK_ZERO\n\nstates.c:__clean_func_state() can downgrade scalar zero spill to\nSTACK_ZERO in the following case:\n\n  *(u64 *)(r10 - 8) = 0;\n  ... checkpoint ...\n  r1 = *(u32 *)(r10 - 4);\n  ... no reads from r10-8 ...\n\nHere 4 bytes at r10-8 are dead and verifier changes scalar spill to a\ncombination: 0000pppp (p stands for poison). Such a change breaks\nprecision propagation chains. All places that produce STACK_ZERO\nshould call bpf_mark_chain_precision() for the zero source.\n\nThis patch fixes the bug in a simplest way possible:\navoids converting stack spills of zero to STACK_ZERO.\nTwo smarter approaches are possible:\n- do bpf_mark_chain_precision() from __clean_func_state()\n- check slot liveness information in check_stack_write_fixed_off()\n\nI investigated both and the changes required are a bit tricky,\nhence go with a simple fix for the time being."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/states.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"be23266b4a08540aa43d8503a2ea10247c8daebe","lessThan":"436fa689630b741a77ef8c4a6f426479affd5bac","versionType":"git","status":"affected"},{"version":"be23266b4a08540aa43d8503a2ea10247c8daebe","lessThan":"2f3536bff8823d3c5fdbbe15e17bfca696cc2b2e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/states.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2.7","matchCriteriaId":"14D603E7-156F-4FD7-926F-F8D893FBAD60"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/2f3536bff8823d3c5fdbbe15e17bfca696cc2b2e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/436fa689630b741a77ef8c4a6f426479affd5bac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98133","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:44.710","lastModified":"2026-10-19T10:18:12.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: leave HasEA flag untouched on setxattr failure\n\nIn ntfs_set_ea(), the exit path unconditionally updates the HasEA\nflag based on ea_info_qsize. When an error occurs before\nea_info_qsize is updated, NInoClearHasEA() hides existing on-disk\nEAs until the inode is evicted.\n\nOnly update the flag on success."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs/ea.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fc053f05ca282a5e760b41f6560ac835c4e28037","lessThan":"5811a08310754cbf4a1122c81d14c54b8873c35c","versionType":"git","status":"affected"},{"version":"fc053f05ca282a5e760b41f6560ac835c4e28037","lessThan":"ac727d86fb84bdc9626ba9c756c26767459f3083","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs/ea.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2.7","matchCriteriaId":"14D603E7-156F-4FD7-926F-F8D893FBAD60"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/5811a08310754cbf4a1122c81d14c54b8873c35c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/ac727d86fb84bdc9626ba9c756c26767459f3083","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98134","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:44.820","lastModified":"2026-10-21T13:21:24.020","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: check_cond_jmp_op(): properly infer if register is null\n\nNicholas Carlini reported a bug when verifier can incorrectly infer\nthat a pointer is non-null. The bug occurs when two pointers are\ncompared and one of them has a type w/o PTR_MAYBE_NULL flag,\nbut which allows a value to be NULL at runtime.\nHere is an example:\n\n  // `a` is PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED\n  // `a` is 0 at runtime.\n  // `b` is PTR_TO_MAP_VALUE | PTR_MAYBE_NULL\n  void *a = bpf_rdonly_cast(0, 0);\n  int  *b = bpf_map_lookup_elem(...);\n\n  if (a == b)\n    *b = 42;  // verifier does not catch null pointer dereference\n\nThis happens because of a special case in check_cond_jmp_op(),\nwhich attempts to strip PTR_MAYBE_NULL flags from pointer types,\nwhen processing comparisons like `rA == rB`, if either rA or rB can't\nbe null.\n\nThe non-null property is derived based on the absence of\nPTR_MAYBE_NULL flag on rA's or rB's type. But that is not sufficient\nfor types like PTR_TO_MEM, as in the example.\n\nThis patch replaces type_may_be_null() call with reg_not_null(),\nwhich contains an allowlist of types for which absence of\nPTR_MAYBE_NULL actually means that the value can't be NULL at runtime.\n\nAt the moment, the list in the reg_not_null() omits two types for\nwhich PTR_MAYBE_NULL is applicable: PTR_TO_XDP_SOCK and PTR_TO_BUF.\nIn order to remain backward compatible, and assuming that only\ncomparison between pointers of the same type makes sense,\nthis commit extends reg_not_null(). W/o such an extension e.g.\nverifier_jeq_infer_not_null/null_ptr_to_map_value fails.\n\nreg_not_null() can be extended further, but I deem that out of scope\nfor the fix at hand. Explicit base_type(...) != PTR_TO_BTF_ID\nchecks in the check_cond_jmp_op() can be removed with migration to\nreg_not_null(), but that is a behavioural change, as the special case\nwould start matching for PTR_TO_BTF_ID that is also is_trusted_reg().\nI omit the behavioural change from this commit."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"befae75856ab406a3f3fab2aa2118cf3b2dfe3e6","lessThan":"d51cd486930f5bcfd4b55d55ab8e47b03f93d2ed","versionType":"git","status":"affected"},{"version":"befae75856ab406a3f3fab2aa2118cf3b2dfe3e6","lessThan":"dfd8f8adda565e08c370c45cf9d6b2511ba9b5c6","versionType":"git","status":"affected"},{"version":"befae75856ab406a3f3fab2aa2118cf3b2dfe3e6","lessThan":"9bf96b4347f541604b3caadeabda0773d9ceaf2a","versionType":"git","status":"affected"},{"version":"befae75856ab406a3f3fab2aa2118cf3b2dfe3e6","lessThan":"b55c9f019e169ed0d01394f96e172286a8b21b99","versionType":"git","status":"affected"},{"version":"befae75856ab406a3f3fab2aa2118cf3b2dfe3e6","lessThan":"d3ef6c097ba078e1f8c7239d76a0ce8b61e75095","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-476"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"7.2.7","matchCriteriaId":"DBB72E3F-F916-4169-9DD1-11732F9A549E"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/9bf96b4347f541604b3caadeabda0773d9ceaf2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b55c9f019e169ed0d01394f96e172286a8b21b99","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d3ef6c097ba078e1f8c7239d76a0ce8b61e75095","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d51cd486930f5bcfd4b55d55ab8e47b03f93d2ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dfd8f8adda565e08c370c45cf9d6b2511ba9b5c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98135","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:44.933","lastModified":"2026-10-19T10:18:12.687","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: reject invalid sectors_per_cluster in the boot sector\n\nis_boot_sector_ntfs() checks the boot sector's sectors_per_cluster field\nwith a range test that rejects 0x81..0xf3 but accepts 0 and other\nnon-power-of-two counts. A zero value reaches parse_ntfs_boot_sector():\n\n\tsectors_per_cluster_bits = ffs(sectors_per_cluster) - 1;\n\t...\n\tvol->cluster_size = vol->sector_size << sectors_per_cluster_bits;\n\nffs(0) is 0, so sectors_per_cluster_bits becomes (unsigned)-1 and the\nshift is undefined:\n\n  UBSAN: shift-out-of-bounds in fs/ntfs/super.c:673:39\n  shift exponent 4294967295 is too large for 32-bit type 'int'\n\nThis change rejects any non-power-of-two value, since it feeds the\naforementioned shift via ffs() - 1, which only yields the correct shift for a\npower of two."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6251f0b0de7d645e3591931ca4c11d8322c1866f","lessThan":"7524c3145a3bac92bebbc47a29c007f1d874c9b3","versionType":"git","status":"affected"},{"version":"6251f0b0de7d645e3591931ca4c11d8322c1866f","lessThan":"323751a604e7533fa473874d999371592a614207","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2.7","matchCriteriaId":"14D603E7-156F-4FD7-926F-F8D893FBAD60"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/323751a604e7533fa473874d999371592a614207","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/7524c3145a3bac92bebbc47a29c007f1d874c9b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98136","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:45.043","lastModified":"2026-10-19T10:18:12.787","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: bound $AttrDef table walk to the loaded table size\n\nntfs_attr_find_in_attrdef() walks the in-memory $AttrDef table, but the\nloop condition bounds only the start of each entry, not the whole entry:\n\n\tfor (ad = vol->attrdef; (u8 *)ad - (u8 *)vol->attrdef <\n\t\t\tvol->attrdef_size && ad->type; ++ad)\n\nstruct attr_def is 160 bytes; the guard reads ad->type at offset 128 and\nthe loop body reads further fields. vol->attrdef is kvzalloc(i_size),\nwhere i_size is the on-disk $AttrDef data size, checked in\nload_and_init_attrdef() only as 0 < i_size <= 0x7fffffff. A volume whose\n$AttrDef data size is smaller than one entry (e.g. 120 bytes) makes the\nread of ad->type run past the allocation. Creating a file reaches this\nthrough ntfs_attr_size_bounds_check() and reads out of bounds:\n\n  BUG: KASAN: slab-out-of-bounds in ntfs_attr_find_in_attrdef+0x66/0xa0\n  Read of size 4 at addr ffff888005833280 by task init/1\n   ntfs_attr_find_in_attrdef\n   ntfs_attr_size_bounds_check\n   ntfs_attr_can_be_non_resident\n   ntfs_attr_add\n\nRequire the whole entry to lie within attrdef_size in the loop guard, and\nreject at mount a $AttrDef too small to hold one attr_def entry."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs/attrib.c","fs/ntfs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","lessThan":"3e2ae47b8ebc632c27e7843a4632d9a7c060885e","versionType":"git","status":"affected"},{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","lessThan":"c8504fc1245f5322af5fa5c325ab05f9cf792b87","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs/attrib.c","fs/ntfs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2.7","matchCriteriaId":"14D603E7-156F-4FD7-926F-F8D893FBAD60"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/3e2ae47b8ebc632c27e7843a4632d9a7c060885e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/c8504fc1245f5322af5fa5c325ab05f9cf792b87","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98137","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:45.160","lastModified":"2026-10-19T10:18:12.893","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: treat any nonzero dio zero-range return as an error\n\nntfs_dio_zero_range() returns either 0 or a negative errno from\nblkdev_issue_zeroout(); it never returns a positive value.  The\nzeroing failure check in ntfs_attr_fallocate() therefore never fired,\nso a failed zeroing operation was silently ignored: the loop kept\ngoing, the newly allocated clusters were folded into initialized_size\nand the write could succeed leaving stale on-disk data.\n\nTreat any nonzero return as an error and abort the allocation."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs/attrib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"495e90fa334828d4119061e2726af51d0a0fb4ed","lessThan":"56392b0d5290ff2b05fc673bc07803b8ae4cfd1b","versionType":"git","status":"affected"},{"version":"495e90fa334828d4119061e2726af51d0a0fb4ed","lessThan":"607a9478833db656e7ceac8e9e382fa4acfde545","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs/attrib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2.7","matchCriteriaId":"14D603E7-156F-4FD7-926F-F8D893FBAD60"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/56392b0d5290ff2b05fc673bc07803b8ae4cfd1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/607a9478833db656e7ceac8e9e382fa4acfde545","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98138","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:45.273","lastModified":"2026-10-19T10:18:13.003","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: do not mark the volume clean in sync_fs when errors were recorded\n\nntfs_put_super() and the remount-read-only path both clear the dirty bit\nonly when NVolErrors(vol) is false. ntfs_sync_fs() clears it\nunconditionally, so any sync() on a volume that recorded an error marks\nthat volume clean. A volume without this set is then seen as not needing\nrecovery and it does not run one, so whatever went wrong is never repaired.\n\nThis change skips resetting the dirty bit when there are volume errors.\n\nReproduced on a volume whose $MFTMirr does not match $MFT, which sets the\nerror flag while leaving the mount read-write: after a write and a sync,\nthe on-disk volume flags read 0x0000 with this driver and 0x0001 with the\nguard in place."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6251f0b0de7d645e3591931ca4c11d8322c1866f","lessThan":"ca1f9933eff777a604eb664d0f9ae433b8664cbf","versionType":"git","status":"affected"},{"version":"6251f0b0de7d645e3591931ca4c11d8322c1866f","lessThan":"0e4c839905418d55bafe571a92533a1d1ac7b0a8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2.7","matchCriteriaId":"14D603E7-156F-4FD7-926F-F8D893FBAD60"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0e4c839905418d55bafe571a92533a1d1ac7b0a8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/ca1f9933eff777a604eb664d0f9ae433b8664cbf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98139","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:45.383","lastModified":"2026-10-19T10:18:13.113","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: only count successfully cleared runs when freeing clusters\n\nntfs_cluster_free_from_rl_nolock() adds a run's length to nr_freed\nwhenever the error bookkeeping condition is false, which includes\ncases where ntfs_bitmap_clear_run() actually failed - e.g. a second\nrun failing with the same errno as an earlier one, or any failure\nafter a non-ENOMEM error was already recorded. Since a failed\nntfs_bitmap_clear_run() rolls back its partial modifications, no\nbits were cleared for that run, yet its length still inflates\nvol->free_clusters, corrupting statfs output and the allocator's\nfree space gate.\n\nOnly count runs whose bitmap clear succeeded."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs/lcnalloc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"11ccc9107dc460de28af90fac1f42404d9802735","lessThan":"7eb97d8828e7758b9c81277f7802e740a800f78a","versionType":"git","status":"affected"},{"version":"11ccc9107dc460de28af90fac1f42404d9802735","lessThan":"be9e89ccb8e52a3e4b67feeb03ebd8133091dc7e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs/lcnalloc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2.7","matchCriteriaId":"14D603E7-156F-4FD7-926F-F8D893FBAD60"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/7eb97d8828e7758b9c81277f7802e740a800f78a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/be9e89ccb8e52a3e4b67feeb03ebd8133091dc7e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98140","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:45.497","lastModified":"2026-10-19T10:18:13.223","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix kmap_local leak in write_mft_record_nolock() error paths\n\nwrite_mft_record_nolock() maps the MFT record folio with\nkmap_local_folio(), but the pre_write_mst_fixup() and\nbio_add_folio() failure paths jump to the error label without\nunmapping it. kmap_local mappings are stack-ordered per task, so\nleaking one corrupts the nesting for any outer mapping.\n\nUnmap the folio on those error paths too."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs/mft.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"115380f9a2f9675c7924563cbba70d40cae8fb81","lessThan":"5d7f7bf8fba8cf563b42b44aa4ab3d9928ac480c","versionType":"git","status":"affected"},{"version":"115380f9a2f9675c7924563cbba70d40cae8fb81","lessThan":"cf06dcd572845723821b54a608fc2da995c3c8e2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs/mft.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5d7f7bf8fba8cf563b42b44aa4ab3d9928ac480c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf06dcd572845723821b54a608fc2da995c3c8e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98141","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:45.603","lastModified":"2026-10-19T10:18:13.367","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: propagate reparse index insertion failure\n\nupdate_reparse_data() ignores the return value of\nset_reparse_index(). When index insertion fails, the code removes\nthe just-written reparse data as cleanup but still returns 0, so\nsymlink(2) (and WSL special file creation) reports success while\nno reparse data exists on disk. When there was no previous reparse\ndata (oldsize == 0), the failure was likewise silently ignored.\n\nPropagate the error to the caller."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs/reparse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fc053f05ca282a5e760b41f6560ac835c4e28037","lessThan":"c62f446c63398dc7151f413069bf617032cf7a71","versionType":"git","status":"affected"},{"version":"fc053f05ca282a5e760b41f6560ac835c4e28037","lessThan":"9692b1b4fc00cf89628bc43f71729ab21f14f8d3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs/reparse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/9692b1b4fc00cf89628bc43f71729ab21f14f8d3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c62f446c63398dc7151f413069bf617032cf7a71","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98142","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:45.710","lastModified":"2026-10-19T10:18:13.510","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/cirrus-qemu: Validate BAR0 size during probe\n\nThe `cirrus-qemu` driver relies on `CIRRUS_VRAM_SIZE` (4 MB) to validate\nframebuffer sizes. However, during PCI probe, the driver mapped BAR0\nwithout verifying that its size matches `CIRRUS_VRAM_SIZE`.\n\nIf a PCI device with a BAR0 smaller than 4 MB is bound to the driver, the\nmapped VRAM will be smaller than expected. Because validation checks assume\n4 MB VRAM, framebuffers larger than the mapped memory can be created.\n\nWhen the display plane is updated (e.g. during release),\n`cirrus_primary_plane_helper_atomic_update()` copies the framebuffer to\nVRAM using `drm_fb_memcpy()`. Writing past the end of the mapped I/O memory\ncauses a supervisor write page fault:\n\nBUG: unable to handle page fault for address: ffffc9000389c000\n...\nRIP: 0010:memcpy_toio+0x7c/0xe0 arch/x86/lib/iomem.c:110\n...\nCall Trace:\n <TASK>\n iosys_map_memcpy_to include/linux/iosys-map.h:285 [inline]\n drm_fb_memcpy+0x325/0x5d0 drivers/gpu/drm/drm_format_helper.c:442\n cirrus_primary_plane_helper_atomic_update+0x98a/0xb00\n drivers/gpu/drm/tiny/cirrus-qemu.c:358\n drm_atomic_helper_commit_planes+0x626/0xea0\n drivers/gpu/drm/drm_atomic_helper.c:3038\n drm_atomic_helper_commit_tail+0x60/0x510\n drivers/gpu/drm/drm_atomic_helper.c:1989\n commit_tail+0x2b1/0x3c0 drivers/gpu/drm/drm_atomic_helper.c:2074\n drm_atomic_helper_commit+0xa77/0xb10\n drivers/gpu/drm/drm_atomic_helper.c:2312\n\nFix this by validating in `cirrus_pci_probe()` that the PCI BAR0 resource\nis not less than `CIRRUS_VRAM_SIZE`, returning `-ENODEV` if it is less."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/tiny/cirrus-qemu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ab3e023b1b4c9887c9f0f761b47f3f0516bd3434","lessThan":"2a0e7bcff3fa63e7309d2b39e18af59eb8ef2b6e","versionType":"git","status":"affected"},{"version":"ab3e023b1b4c9887c9f0f761b47f3f0516bd3434","lessThan":"0b5084a1f070ad1fc34e11945644ae034bbc774c","versionType":"git","status":"affected"},{"version":"ab3e023b1b4c9887c9f0f761b47f3f0516bd3434","lessThan":"26bd90c886218f36c9adeab206b0e27b4384e2f6","versionType":"git","status":"affected"},{"version":"ab3e023b1b4c9887c9f0f761b47f3f0516bd3434","lessThan":"144f51cd0ccc3ad47a6099917b7bb535611fb18f","versionType":"git","status":"affected"},{"version":"ab3e023b1b4c9887c9f0f761b47f3f0516bd3434","lessThan":"92312d333bf700798f92f30406c721bce87506f3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/tiny/cirrus-qemu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.2","status":"affected"},{"version":"0","lessThan":"5.2","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0b5084a1f070ad1fc34e11945644ae034bbc774c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/144f51cd0ccc3ad47a6099917b7bb535611fb18f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/26bd90c886218f36c9adeab206b0e27b4384e2f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a0e7bcff3fa63e7309d2b39e18af59eb8ef2b6e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/92312d333bf700798f92f30406c721bce87506f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98143","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:45.830","lastModified":"2026-10-19T10:18:13.673","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel: ethosu: Don't read the U65 rounding mode as a storage mode\n\nBits 15:14 of NPU_SET_{IFM,OFM}_PRECISION select the activation storage\nmode on U85 only. On U65 the same field holds the rounding mode, and the\ncommand stream parser has read it as a storage mode since the driver was\nadded.\n\nThat went unnoticed while unknown values fell through the switch, but\nnow that they are rejected, every U65 command stream that asks for\nnatural rounding (2) fails CMDSTREAM_BO_CREATE with -EINVAL. Mesa emits\nit for average pooling, concatenation, split, unpack, strided slice, LUT\nand argmax, which is 72 failures of the Teflon test suite on an i.MX93.\nTruncating rounding (1) is misread as well: it picks the two-tile\naddress path and computes a bogus feature map size from tile bases the\ncommand stream never set.\n\nRead the field as a storage mode only on the hardware where it is one."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/accel/ethosu/ethosu_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b","lessThan":"6b08adbda8ea797849e3654ce12cb3856ce6051a","versionType":"git","status":"affected"},{"version":"5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b","lessThan":"db9deec5a345abc538d081fb221dc0b00a9695bd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/accel/ethosu/ethosu_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/6b08adbda8ea797849e3654ce12cb3856ce6051a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db9deec5a345abc538d081fb221dc0b00a9695bd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98144","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:45.933","lastModified":"2026-10-19T10:18:13.837","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: put the chained BO when its mapping fails\n\namdxdna_cmd_set_error() looks up the first BO of a command chain, which\ntakes a reference, and drops it at the end of the function. The mapping of\nthat BO is established in between, and the failure path returns without the\nput, so the reference is leaked.\n\nOrdinary use does not reach it. The chain has been submitted before any of\nthis runs, so aie2_cmdlist_fill_slot() has already called\namdxdna_cmd_get_op() on that BO and amdxdna_gem_vmap() has cached its\naddress. What makes it reachable is that the BO is resolved again by\nhandle here, and the handle is userspace's to recycle: closing it after\nsubmission and importing a dma-buf whose exporter implements no vmap onto\nthe same id leaves amdxdna_gem_get_obj() returning an object this cannot\nmap, since prime_import() types every import AMDXDNA_BO_SHARE."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/accel/amdxdna/amdxdna_ctx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d76856beb4a4a6c42244054cd780c00f2d33de4e","lessThan":"eb90cb257e0792ac11f0347254bad3fc72417db6","versionType":"git","status":"affected"},{"version":"d76856beb4a4a6c42244054cd780c00f2d33de4e","lessThan":"7e33ba3a1d48c2d20ed270dec9d2d08332585c8e","versionType":"git","status":"affected"},{"version":"33819cca7b76d5c2385c054f054c4b672ab989d5","versionType":"git","status":"affected"},{"version":"6.18.57","lessThan":"6.19","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/accel/amdxdna/amdxdna_ctx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/7e33ba3a1d48c2d20ed270dec9d2d08332585c8e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb90cb257e0792ac11f0347254bad3fc72417db6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98145","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:46.043","lastModified":"2026-10-19T10:18:13.983","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: reject a command chain that carries no commands\n\nA chain whose command_count is zero passes the payload length check,\nbecause struct_size(payload, data, 0) is just the header. The fill loop\nthen does not run, so offset stays zero and the request is submitted with\na zero-length buffer.\n\nOn firmware without AIE2_NPU_COMMAND that ends at the opcode check, since\nop is still ERT_INVALID_CMD and aie2_get_chain_msg_op() answers\nMSG_OP_MAX_OPCODE. aie2_get_npu_chain_msg_op() answers\nMSG_OP_CHAIN_EXEC_NPU whatever it is given, so there the submission\ncontinues to drm_clflush_virt_range(cmd_buf, 0), which reads the byte\nbefore the buffer and faults on the vmap guard page. EXEC_CMD is\nreachable by any process that can open the render node.\n\nReject the request instead."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/accel/amdxdna/aie2_message.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8ed8b02396172b137ca8c78c3cb999ddf4fb0bbf","lessThan":"ed74e8d603df457bfcf16ed4f8f1660a1525759e","versionType":"git","status":"affected"},{"version":"8ed8b02396172b137ca8c78c3cb999ddf4fb0bbf","lessThan":"ef6d27af71e1dc43181ec797a6aaa77c27c36786","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/accel/amdxdna/aie2_message.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/ed74e8d603df457bfcf16ed4f8f1660a1525759e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ef6d27af71e1dc43181ec797a6aaa77c27c36786","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98146","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:46.147","lastModified":"2026-10-22T00:45:29.527","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain\n\nstruct amdxdna_cmd_chain contains a flexible array annotated with\n__counted_by(command_count). Since the structure is stored in shared\nAMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently.\nIf command_count is changed to zero, the bounds check generated from\n__counted_by may fail and trigger a kernel panic.\n\nRemove __counted_by to avoid relying on the userspace-controlled\ncommand_count for the flexible array bounds check."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/accel/amdxdna/amdxdna_ctx.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"aac243092b707bb3018e951d470cc1a9bcbaba6c","lessThan":"93fa3e925b15b0ded0a549fe7f12bfbb1c4e171a","versionType":"git","status":"affected"},{"version":"aac243092b707bb3018e951d470cc1a9bcbaba6c","lessThan":"52f3e086760a9a3e02a46a10b57caffd73b1c204","versionType":"git","status":"affected"},{"version":"aac243092b707bb3018e951d470cc1a9bcbaba6c","lessThan":"b3709d354545e70388177500761f92d906c4dfd6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/accel/amdxdna/amdxdna_ctx.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"6.18.53","matchCriteriaId":"3715AAFB-3916-4AF2-BE3B-9D0A16B1B82D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/52f3e086760a9a3e02a46a10b57caffd73b1c204","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/93fa3e925b15b0ded0a549fe7f12bfbb1c4e171a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/b3709d354545e70388177500761f92d906c4dfd6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98147","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:46.257","lastModified":"2026-10-21T13:21:24.160","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nprintk: Don't WARN on kthread_run failure.\n\nSince __kthread_create_on_node() returns -EINTR upon SIGKILL,\nwe should not use WARN_ON() in order to catch kthread_run() failure."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/printk/nbcon.c","kernel/printk/printk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"76f258bf3f2aae570209319944703a92ac64e29e","lessThan":"15ba35d632c38d879d182577b0af487de0f2dec4","versionType":"git","status":"affected"},{"version":"76f258bf3f2aae570209319944703a92ac64e29e","lessThan":"0af43b52fe4b1751b731c067127fdf47cf1b700c","versionType":"git","status":"affected"},{"version":"76f258bf3f2aae570209319944703a92ac64e29e","lessThan":"4e676279798148382497d0e38c0bd51115e64be1","versionType":"git","status":"affected"},{"version":"76f258bf3f2aae570209319944703a92ac64e29e","lessThan":"72dd0ec09e7cc98ed58ddeac26575e5d1ab8a93d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/printk/nbcon.c","kernel/printk/printk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0af43b52fe4b1751b731c067127fdf47cf1b700c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/15ba35d632c38d879d182577b0af487de0f2dec4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4e676279798148382497d0e38c0bd51115e64be1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72dd0ec09e7cc98ed58ddeac26575e5d1ab8a93d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98148","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:46.363","lastModified":"2026-10-21T13:21:24.323","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gud: validate GUD_ROTATION_0 is present in supported rotations\n\nThe rotation argument to drm_plane_create_rotation_property() is set to\nDRM_MODE_ROTATE_0, and the device reported rotation bitmask is used as\nthe supported_rotations argument. The driver never validates that\nGUD_ROTATION_0 is present, so a device that omits it from its\nGUD_PROPERTY_ROTATION triggers the\nWARN_ON(rotation & ~supported_rotations) in\ndrm_plane_create_rotation_property()\n\nFix this by skipping the creation of rotation property if the device\ndoesn't have the GUD_ROTATION_0 bit"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/gud/gud_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"ce7da178f1af4e9cbac4d0440c4002785546bfb5","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"962cdf2eedb2708eb99c25ffb56c6d6981d41ed6","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"b2cd682324b889011874cf844b7c7efa97c97296","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"876b33d8a9a00e9d4bbcbb7f55ad2c05974850de","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"cb732d027aa18e1fcf9d2797f47d20b179ebc59c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/gud/gud_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/876b33d8a9a00e9d4bbcbb7f55ad2c05974850de","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/962cdf2eedb2708eb99c25ffb56c6d6981d41ed6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2cd682324b889011874cf844b7c7efa97c97296","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cb732d027aa18e1fcf9d2797f47d20b179ebc59c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce7da178f1af4e9cbac4d0440c4002785546bfb5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98149","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:46.473","lastModified":"2026-10-21T20:36:19.900","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix percpu map update indexing with sparse CPU IDs\n\nPer-CPU array, hash, and cgroup storage map updates without BPF_F_CPU\nor BPF_F_ALL_CPUS use a value buffer whose per-CPU slots are packed in\npossible-CPU order. The buffer is sized as:\n\n  round_up(value_size, 8) * num_possible_cpus()\n\nThe update paths iterate over possible CPUs, but use the logical CPU ID\nto calculate the source offset:\n\n  value + size * cpu\n\nThis only works when possible CPU IDs are contiguous starting at zero.\n\nFor example, with a possible CPU mask of 0,2-3, the buffer contains\nthree slots corresponding to CPUs 0, 2, and 3. CPU2 is therefore\nexpected to use slot 1 and CPU3 slot 2. Instead, the current code uses\nslots 2 and 3 respectively, causing incorrect per-CPU values and an\nout-of-bounds read from the update buffer for CPU3.\n\nThe corresponding lookup paths already use a dense offset while\niterating over possible CPUs. Do the same for the array, hash, and\ncgroup storage update paths, advancing the source offset once for each\npossible CPU. BPF_F_ALL_CPUS continues to use the same value for every\nCPU."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/arraymap.c","kernel/bpf/hashtab.c","kernel/bpf/local_storage.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8eb76cb03f0f6c2bd7b15cf45dcffcd6bd07a360","lessThan":"c16c62c91e5d6737a9fbb0a541b8b34610470a2b","versionType":"git","status":"affected"},{"version":"8eb76cb03f0f6c2bd7b15cf45dcffcd6bd07a360","lessThan":"75b0a6db4300e4c2c9e97a0848deaa7acfb42fb7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/arraymap.c","kernel/bpf/hashtab.c","kernel/bpf/local_storage.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0","versionEndExcluding":"7.2.7","matchCriteriaId":"DB28EE51-99BD-418E-A2D4-11E0565C193D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/75b0a6db4300e4c2c9e97a0848deaa7acfb42fb7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/c16c62c91e5d6737a9fbb0a541b8b34610470a2b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98150","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:46.580","lastModified":"2026-10-21T20:24:26.410","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix BPF_F_CPU validation for sparse CPU IDs\n\nBPF_F_CPU stores the target CPU ID in the upper 32 bits of the map\noperation flags. bpf_map_check_op_flags() currently compares that ID\nwith num_possible_cpus(), which is the number of possible CPUs rather\nthan a bound on CPU IDs.\n\nOn an arm64 QEMU guest with a CPU device-tree hole, the possible CPU\nmask was 0,2-3. A userspace program using raw bpf() syscalls creates\na BPF_MAP_TYPE_PERCPU_ARRAY and performs update and lookup operations\nfor each CPU by setting BPF_F_CPU and the CPU ID in the flags.\n\nWith the old check, CPU 1 is incorrectly accepted while valid CPU 3 is\nrejected with -ERANGE. The CPU 1 update then reaches the per-CPU map\naccess path and triggers:\n\n  Unable to handle kernel paging request at virtual address ...\n  pc : __pi_memcpy_generic+0x5c/0x22c\n  lr : bpf_percpu_array_update+0x2dc/0x2e8\n  Call trace:\n    __pi_memcpy_generic\n    bpf_map_update_value\n    map_update_elem\n    __sys_bpf\n\nCheck the CPU ID against nr_cpu_ids and cpu_possible() instead. This\nrejects CPU IDs outside the valid range and CPUs absent from the\npossible mask, while allowing valid sparse CPU IDs."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/bpf.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2b421662c7887a0649fe409155a1f101562d0fa9","lessThan":"bdc5941f6eeef90b76a07fd8ca38ac1933ba2195","versionType":"git","status":"affected"},{"version":"2b421662c7887a0649fe409155a1f101562d0fa9","lessThan":"ed54bf564ac52699cf4def3d0c2125d493e756f9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/bpf.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0","versionEndExcluding":"7.2.7","matchCriteriaId":"DB28EE51-99BD-418E-A2D4-11E0565C193D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/bdc5941f6eeef90b76a07fd8ca38ac1933ba2195","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/ed54bf564ac52699cf4def3d0c2125d493e756f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98151","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:46.693","lastModified":"2026-10-21T20:19:50.470","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic\n\nTake the following unprivileged program as an example:\n\n\tr0 = bpf_map_lookup_elem(...)\t/* PTR_TO_MAP_VALUE, offset 0 */\n\t...\n\t14: r0 += r1\t\t\t/* r1 is a bounded scalar */\n\t15: r9 = r0\n\nLoading it triggers a verifier warning from reg_bounds_sanity_check():\n\n\tverifier bug: REG INVARIANTS VIOLATION (alu): const subreg tnum out\n\tof sync with range bounds r64={.base=0x0, .size=0x0}\n\tr32={.base=0x0, .size=0xffffffff} var_off=(0x0, 0x0)\n\nWhat happens:\n\n1. Processing insn 14 (r0 += r1) in adjust_ptr_min_max_vals(), the new\n   offset is computed into dst_reg's var_off and 32/64-bit ranges.\n\n2. Because pointer registers do not track 32-bit subregister bounds,\n   __mark_reg32_unbounded() first sets r32 to the full range; r32 is\n   re-derived from the offset at the end of the function by\n   reg_bounds_sync().\n\n3. On the unprivileged path, sanitize_ptr_alu() is called and, via\n   sanitize_speculative_path() -> push_stack(), snapshots the current\n   register state and schedules the next instruction (insn 15) to be\n   verified directly as a speculative path.\n\n4. That snapshot is taken between step 2 and the final reg_bounds_sync():\n   at this point dst_reg's var_off still holds the (const) original\n   offset while r32 has just been blanked to the full range, i.e. the two\n   are out of sync. When the speculative path later verifies insn 15\n   (r9 = r0), the inconsistent state reaches reg_bounds_sanity_check() and\n   trips the warning.\n\nvar_off and the 32-bit range must always be consistent. There are two\nways to keep the snapshot consistent:\n\n  1. sync var_off and r32 before the snapshot so they match, or\n  2. leave r32 at its original (already consistent) value and blank it\n     only after the snapshot.\n\nThe whole point of sanitize_ptr_alu() is to insert a harmless masking\nsequence that keeps the access in bounds under speculation, so the state\nit snapshots should faithfully represent that. Take approach 2: move\n__mark_reg32_unbounded() to after sanitize_ptr_alu(), so the speculative\nsnapshot keeps the pointer's original, consistent r32. The non-speculative\npath is unchanged: r32 is still blanked before the offset is applied and\nre-derived by reg_bounds_sync()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5f99f312bd3bedb3b266b0d26376a8c500cdc97f","lessThan":"21a681526c715aebb4f918b8c131583442d1b3d8","versionType":"git","status":"affected"},{"version":"5f99f312bd3bedb3b266b0d26376a8c500cdc97f","lessThan":"d623a4a58bb238443505d5c2949d1182dcfc26b6","versionType":"git","status":"affected"},{"version":"5f99f312bd3bedb3b266b0d26376a8c500cdc97f","lessThan":"9f9477ae73de9c5a28e8ab7000d8097b078faee4","versionType":"git","status":"affected"},{"version":"5f99f312bd3bedb3b266b0d26376a8c500cdc97f","lessThan":"150aeba624e8b7cac51c39440d7e8e1fd11de9a0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-617"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.12.111","matchCriteriaId":"0AAE1C50-EBD8-45BA-8A1F-E7922EC80F56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/150aeba624e8b7cac51c39440d7e8e1fd11de9a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/21a681526c715aebb4f918b8c131583442d1b3d8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/9f9477ae73de9c5a28e8ab7000d8097b078faee4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d623a4a58bb238443505d5c2949d1182dcfc26b6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98152","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:46.820","lastModified":"2026-10-19T10:18:14.987","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-rdma: fix queue leak when connect backlog is exceeded\n\nWhen pending disconnecting queues exceed the backlog limit, the\nconnect path only drops the device reference and leaks the newly\nallocated queue and its IB resources."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/nvme/target/rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"204b9645536bb4a77a2cb35e6519dbf9f4ea1665","lessThan":"186414a6a1a34e081b07e8873622f90402346235","versionType":"git","status":"affected"},{"version":"00eaa58988d35fd47ca8811f7f72871591f61ffb","lessThan":"e48f9d1076f8c62c3969588d638602b94aaeff12","versionType":"git","status":"affected"},{"version":"712f3268a62d0df98a7ee991cba963ced2e58007","lessThan":"32e598324edc3ebb1ac9362d5b9fc30ce0de4873","versionType":"git","status":"affected"},{"version":"d65fe42820b890a6a4644de0a95a812471f79ad3","lessThan":"287420cde9d6669abcd2878c344db67423eb7df6","versionType":"git","status":"affected"},{"version":"a8803c4f0ac3fa7df5551bbb5a8800c434a94357","lessThan":"4f7cf573cdf0ee857448b9b1967d686b07c71e7d","versionType":"git","status":"affected"},{"version":"badc53620fe813b3a9f727ef9526f98567c2c898","lessThan":"60d56bf0b14d3c545bacb9aeef92a7e6f2cf0caa","versionType":"git","status":"affected"},{"version":"badc53620fe813b3a9f727ef9526f98567c2c898","lessThan":"fb1ed67788e21832b614c23767a088c08cfdd2f2","versionType":"git","status":"affected"},{"version":"5828517d17eda27f21d29ea14800c9e0a57bad11","versionType":"git","status":"affected"},{"version":"6.12.96","lessThan":"6.12.111","versionType":"semver","status":"affected"},{"version":"6.18.39","lessThan":"6.18.53","versionType":"semver","status":"affected"},{"version":"7.1.4","lessThan":"7.2","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/nvme/target/rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-401"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.96","versionEndExcluding":"6.12.111","matchCriteriaId":"D2623A50-55BD-4589-AD5C-711B7215C3B6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18.39","versionEndExcluding":"6.18.53","matchCriteriaId":"E7705E07-FFAE-48C3-BE81-14DDEC478D18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1.4","versionEndExcluding":"7.2.7","matchCriteriaId":"884C2A3B-3C29-41BB-ADFE-525F21B330B2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/186414a6a1a34e081b07e8873622f90402346235","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/287420cde9d6669abcd2878c344db67423eb7df6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/32e598324edc3ebb1ac9362d5b9fc30ce0de4873","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/4f7cf573cdf0ee857448b9b1967d686b07c71e7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/60d56bf0b14d3c545bacb9aeef92a7e6f2cf0caa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e48f9d1076f8c62c3969588d638602b94aaeff12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/fb1ed67788e21832b614c23767a088c08cfdd2f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98153","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:46.937","lastModified":"2026-10-21T19:53:44.253","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix racy access to FDP placement id array\n\nnvme_query_fdp_info() is called per-path and therefore prone to races.\n\nIt populates head->nr_plids/head->plids for fdp registration.\nBut nothing protects that pair from concurrent access - two paths scanning\nthe same namespace can race to populate it.\n\nAvoid the race by moving this initialization work to nvme_alloc_ns_head()\nwhich is called once per shared namespace."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/nvme/host/core.c","drivers/nvme/host/nvme.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"30b5f20bb2ddab013035399e5c7e6577da49320a","lessThan":"e0a23e3c8c4c3ce11529fa70d2292b4e56d143ba","versionType":"git","status":"affected"},{"version":"30b5f20bb2ddab013035399e5c7e6577da49320a","lessThan":"56e1c6bbe4bb084d7ecf61698afdf70be23dd35f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/nvme/host/core.c","drivers/nvme/host/nvme.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.2.7","matchCriteriaId":"A0E12987-1BA8-4196-BF01-9A7B38D0018C"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/56e1c6bbe4bb084d7ecf61698afdf70be23dd35f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e0a23e3c8c4c3ce11529fa70d2292b4e56d143ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98154","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:47.043","lastModified":"2026-10-20T17:00:42.777","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: fix -EIO cleanup order in queue_rq\n\nOn -EIO, the RDMA queue_rq path reports a host path error and then\nstill cleans up the command and unmaps the SQE DMA. The path error\nhelper completes the request, so that is double cleanup and DMA unmap\nafter the request is already complete.\n\nUnmap the SQE first, then report the host path error. Skip the outer\ncommand cleanup on that path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/nvme/host/rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"62eca39722fd997e3621fc903229917b9f0fb271","lessThan":"ccf37fff526cab2d0e6ff2aaf35947f3cf62e5bb","versionType":"git","status":"affected"},{"version":"62eca39722fd997e3621fc903229917b9f0fb271","lessThan":"c2459519b39587c9c27d6b8a8cf516fee10fce66","versionType":"git","status":"affected"},{"version":"62eca39722fd997e3621fc903229917b9f0fb271","lessThan":"965804b20c0f02c1a6cf4b69c0498a79e56f97fe","versionType":"git","status":"affected"},{"version":"62eca39722fd997e3621fc903229917b9f0fb271","lessThan":"a41e7fc8d244d9cfc6273051aed85b67adedbb89","versionType":"git","status":"affected"},{"version":"62eca39722fd997e3621fc903229917b9f0fb271","lessThan":"cf3e706963ffbd3ee2568fa0d08ab016f0575ea8","versionType":"git","status":"affected"},{"version":"62eca39722fd997e3621fc903229917b9f0fb271","lessThan":"171b993a4aed9889159df4815b6a6ba141e61975","versionType":"git","status":"affected"},{"version":"62eca39722fd997e3621fc903229917b9f0fb271","lessThan":"d61828199c6cb4b76d48403c77023cd4bb9d09fc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/nvme/host/rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-415"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"5.15.222","matchCriteriaId":"46166E1F-105E-4AE8-BE30-C7087648EBD2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.1.189","matchCriteriaId":"A08955FE-5938-4F5B-B6A0-BEA8BA740A26"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.158","matchCriteriaId":"4F4B14AC-C632-4A61-9E23-076CC1A04CEA"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.12.111","matchCriteriaId":"25101E3A-E888-4430-B5C5-6D6BC4635597"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2","versionEndExcluding":"7.2.7","matchCriteriaId":"D9F474BB-5197-425C-A9D2-40E492785436"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/171b993a4aed9889159df4815b6a6ba141e61975","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/965804b20c0f02c1a6cf4b69c0498a79e56f97fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/a41e7fc8d244d9cfc6273051aed85b67adedbb89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/c2459519b39587c9c27d6b8a8cf516fee10fce66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/ccf37fff526cab2d0e6ff2aaf35947f3cf62e5bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/cf3e706963ffbd3ee2568fa0d08ab016f0575ea8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d61828199c6cb4b76d48403c77023cd4bb9d09fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98155","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:47.157","lastModified":"2026-10-20T17:19:25.330","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Address potential out-of-bounds read in resp_worker()\n\nAlthough 'commit 2feec5ae5df7 (\"accel/qaic: Handle DBC deactivation if the\nowner went away\")' fixes the scenario it was intended for by walking the\nmessage and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it\nskipped over the bounds checking code that is included in decode_message().\nThis could lead to issues such as reading past the slab allocation's end,\ninfinite loops or kernel panics. For those issues to happen, a malformed\nwire message is needed to be sent from the device.\n\nInstead of duplicating the bounds checking code already present in\ndecode_message(), use the function inside resp_worker()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/accel/qaic/qaic_control.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2dd67966f39a2abf8ccb4865031c722e40e01b7f","lessThan":"5807a65f301b6c0e73a2dc03dd6f5e80a2861b72","versionType":"git","status":"affected"},{"version":"08021f2d4a557d6491e3bcc288e96425f50aa3cf","lessThan":"f4b64488f3deca63f7fbc7d7c3835b2e668003f9","versionType":"git","status":"affected"},{"version":"f403094d9075d7c565a3d81002b781c325cb3c07","lessThan":"12deeade460d47031267256ba07add51cc7eabd0","versionType":"git","status":"affected"},{"version":"2feec5ae5df785658924ab6bd91280dc3926507c","lessThan":"c72e81ee46bdd4c221114d6e9515e9b4647616d7","versionType":"git","status":"affected"},{"version":"2feec5ae5df785658924ab6bd91280dc3926507c","lessThan":"ab243f74ab4084ca5c8dec608cb5b0deb27db067","versionType":"git","status":"affected"},{"version":"ee0180e77e6c8482644569632065411de844c515","versionType":"git","status":"affected"},{"version":"6.6.134","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.12.81","lessThan":"6.12.111","versionType":"semver","status":"affected"},{"version":"6.18.22","lessThan":"6.18.53","versionType":"semver","status":"affected"},{"version":"6.19.12","lessThan":"6.20","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/accel/qaic/qaic_control.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.134","versionEndExcluding":"6.6.158","matchCriteriaId":"A6D60F8E-A2C0-47F9-93EB-9BAA4CC1DB65"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.81","versionEndExcluding":"6.12.111","matchCriteriaId":"B6582683-DBAE-426D-85A2-7EDCF73C8230"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18.22","versionEndExcluding":"6.18.53","matchCriteriaId":"A522C41F-425F-4609-8313-A4346D7B3983"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19.12","versionEndExcluding":"6.20","matchCriteriaId":"BD8391E6-2320-4953-947B-716A99890794"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:-:*:*:*:*:*:*","matchCriteriaId":"EF897730-3F1E-47A2-8B07-22535202C487"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/12deeade460d47031267256ba07add51cc7eabd0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/5807a65f301b6c0e73a2dc03dd6f5e80a2861b72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/ab243f74ab4084ca5c8dec608cb5b0deb27db067","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/c72e81ee46bdd4c221114d6e9515e9b4647616d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f4b64488f3deca63f7fbc7d7c3835b2e668003f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98156","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:47.280","lastModified":"2026-10-21T13:21:24.497","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: use the DMA API for resource backing on Xen\n\nOn a Xen PV domain page addresses bear no relation to the real machine\naddresses the host would have to use to reach it.\nvirtio_ring.c handles this correctly, vring_use_map_api() returns true\nfor any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM.\n\nvirtio-gpu makes the same decision independently, but its copy\nlooks only at the feature bit:\n\n\tbool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);\n\nQEMU does not set iommu_platform on virtio-vga by default, so\nVIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and\nvirtio_gpu_object_shmem_init() describes the framebuffer's backing pages\nto the host with sg_phys().  Those are guest-physical addresses. In a PV\ndomain they resolve, on the host side, to pages belonging to some other\ndomain, so the host scans out unrelated memory.\n\nMove the decision into virtio_gpu_use_dma_api() and give it the\nxen_domain() check, like vring_use_map_api() has. This\nadditionally enables the dma_sync_sgtable_for_device() calls in\nvirtgpu_vq.c, which are required for correctness whenever swiotlb\nis in play.\n\nReproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with\nvirtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0\nworks fine and doesn't need this fix because it is identity-mapped,\nonly PV dom0s are affected."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/virtio/virtgpu_drv.h","drivers/gpu/drm/virtio/virtgpu_object.c","drivers/gpu/drm/virtio/virtgpu_vq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a3b815f09bb846255c458c181b8a5b1cc66891b4","lessThan":"32e999ccf5f6453b3b4df8264ff1b03c6720292f","versionType":"git","status":"affected"},{"version":"a3b815f09bb846255c458c181b8a5b1cc66891b4","lessThan":"3f130cc6826fabf50e01fe8e4ff3ed1fcae50d36","versionType":"git","status":"affected"},{"version":"a3b815f09bb846255c458c181b8a5b1cc66891b4","lessThan":"93c557e947ef0040004b1ac6a1c1265d79a957e1","versionType":"git","status":"affected"},{"version":"a3b815f09bb846255c458c181b8a5b1cc66891b4","lessThan":"455184dbe9652d01470d3c5cf5edd09a7a673a99","versionType":"git","status":"affected"},{"version":"a3b815f09bb846255c458c181b8a5b1cc66891b4","lessThan":"6a736d2f9d0c6e6217fe7532bc4c50ceca71db78","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/virtio/virtgpu_drv.h","drivers/gpu/drm/virtio/virtgpu_object.c","drivers/gpu/drm/virtio/virtgpu_vq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.1,"impactScore":6.0}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"6.18.53","matchCriteriaId":"E1ADF9AB-0E9B-43B4-87D2-BAC187A34EDB"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/32e999ccf5f6453b3b4df8264ff1b03c6720292f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3f130cc6826fabf50e01fe8e4ff3ed1fcae50d36","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/455184dbe9652d01470d3c5cf5edd09a7a673a99","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/93c557e947ef0040004b1ac6a1c1265d79a957e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98157","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:47.397","lastModified":"2026-10-20T17:30:40.097","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation\n\nThe poll_msec sysfs store file uses simple_strtoul() which accepts an unsigned\nlong, but the target field (poll_msec) is unsigned int. On 64-bit systems,\na value > UINT_MAX is silently truncated when stored.\n\nFix the mismatch by using kstrtouint() instead. This rejects values larger\nthan UINT_MAX at parse time, making truncation impossible. Also add a check\nfor value < 1 to reject the 0-delay case, which would cause the poll work to\nspin without delay and consume 100% CPU."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/edac/edac_device_sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e27e3dac651771fe3250f6305dee277bce29fc5d","lessThan":"a60794ee3f453516ab3ed212ba0295ecf890bc8c","versionType":"git","status":"affected"},{"version":"e27e3dac651771fe3250f6305dee277bce29fc5d","lessThan":"f856511058c8cb470d6c6c7ce908870adcdc7dc6","versionType":"git","status":"affected"},{"version":"e27e3dac651771fe3250f6305dee277bce29fc5d","lessThan":"656e2fe98ac452db4e5b8147d1f33b8c35b4ec4b","versionType":"git","status":"affected"},{"version":"e27e3dac651771fe3250f6305dee277bce29fc5d","lessThan":"541fc6f733b32463cf23277637bb07e2aaa00b53","versionType":"git","status":"affected"},{"version":"e27e3dac651771fe3250f6305dee277bce29fc5d","lessThan":"ea01c061d839b520f385f112908de1c6e3391327","versionType":"git","status":"affected"},{"version":"e27e3dac651771fe3250f6305dee277bce29fc5d","lessThan":"528052af901d6e6bbfa0e52362a70a58a5dd1e43","versionType":"git","status":"affected"},{"version":"e27e3dac651771fe3250f6305dee277bce29fc5d","lessThan":"0e022ee4f8e0dc843ba4c80bb75408a7704279af","versionType":"git","status":"affected"},{"version":"e27e3dac651771fe3250f6305dee277bce29fc5d","lessThan":"66cc9dec919dd63d8e4b3d386f7aed3ae684e645","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/edac/edac_device_sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.23","status":"affected"},{"version":"0","lessThan":"2.6.23","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"5.10.271","matchCriteriaId":"B013E82E-88AE-4BEA-85ED-00174726C596"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.222","matchCriteriaId":"71A72718-B484-4334-A55F-4AEF4DC98732"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.1.189","matchCriteriaId":"A08955FE-5938-4F5B-B6A0-BEA8BA740A26"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.158","matchCriteriaId":"4F4B14AC-C632-4A61-9E23-076CC1A04CEA"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.12.111","matchCriteriaId":"25101E3A-E888-4430-B5C5-6D6BC4635597"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0e022ee4f8e0dc843ba4c80bb75408a7704279af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/528052af901d6e6bbfa0e52362a70a58a5dd1e43","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/541fc6f733b32463cf23277637bb07e2aaa00b53","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/656e2fe98ac452db4e5b8147d1f33b8c35b4ec4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/66cc9dec919dd63d8e4b3d386f7aed3ae684e645","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/a60794ee3f453516ab3ed212ba0295ecf890bc8c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/ea01c061d839b520f385f112908de1c6e3391327","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f856511058c8cb470d6c6c7ce908870adcdc7dc6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98158","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:47.510","lastModified":"2026-10-20T18:04:25.047","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nppp_async: drop the errored frame instead of resetting its headroom\n\nppp_receive_nonmp_frame() prepends a two-byte direction tag before running\nthe pass/active BPF filters:\n\n\t*(__be16 *)skb_push(skb, 2) = htons(PPP_FILTER_INBOUND_TAG);\n\nNothing on the receive path guarantees those two bytes of headroom. The\nframe-error path in ppp_async's process_input_packet() resets a reused skb's\nheadroom to zero while claiming to restore it to a freshly allocated state -\nbut a fresh skb from dev_alloc_skb() carries NET_SKB_PAD:\n\n\terr:\n\t\tif (skb) {\n\t\t\t/* make skb appear as freshly allocated */\n\t\t\tskb_trim(skb, 0);\n\t\t\tskb_reserve(skb, - skb_headroom(skb));\n\t\t}\n\nap->rpkt still points at that skb, so the next frame is reassembled into it\nwith no headroom at all. A peer that sends a bad-FCS frame followed by one\nbeginning ff 03 then leaves a single byte of headroom by the time the filter\ntag is pushed, which lands one byte below skb->head:\n\n  skbuff: skb_under_panic: len:49 put:2 head:ffff888003c10000\n          data:ffff888003c0ffff tail:0x30 end:0x640 dev:<NULL>\n  kernel BUG at net/core/skbuff.c:214!\n  RIP: 0010:skb_panic+0x13e/0x230\n  Call Trace:\n   skb_push+0xbd/0x100\n   ppp_receive_nonmp_frame+0x48a/0x1d10\n   ppp_input+0x4e9/0x2f80\n   ppp_async_process+0x2a/0xe0\n   tasklet_action_common+0x20f/0x8a0\n   handle_softirqs+0x18e/0x590\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nZeroing the headroom violates the NET_SKB_PAD guarantee that dev_alloc_skb()\ngives the rest of the receive path. Besides the filter panic above, when CCP\ncompression is enabled ppp_decompress_frame() hands skb->data - 2 to\n->decompress()/->incomp(), which then reads out of bounds before skb->head\nfor the same reason.\n\nRather than restore the headroom, drop the errored frame - as ppp_synctty\nalready does on its error path - and clear ap->rpkt so the next frame is\nreassembled into a fresh skb with proper headroom. This is simpler and fixes\nboth the filter under-panic and the CCP out-of-bounds read.\n\nThe original V1 of this patch made room in ppp_receive_nonmp_frame() with\nskb_cow_head(); Eric pointed out that fixing the root cause in the transport\nis the right approach.\n\nFound by fuzzing the PPP receive path with a mutating peer on a pty; it is an\ninteresting (remote) DoS: root configures PPP, the peer supplies two crashing\nframes. The reproducer (repro-ppp-skb.c, unchanged from v1) panics in about a\nsecond, and returns cleanly with this applied."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ppp/ppp_async.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6722e78c90054101e6797d5944cdc81af9897a0a","lessThan":"25f354c55b8435d1f51b8a0a05a3cfe429358523","versionType":"git","status":"affected"},{"version":"6722e78c90054101e6797d5944cdc81af9897a0a","lessThan":"a86a17745c3e1c6fadd4d6e90c03552dfe531c8c","versionType":"git","status":"affected"},{"version":"6722e78c90054101e6797d5944cdc81af9897a0a","lessThan":"ff035780adb0f49dc2c7ada26b4697849a68bec8","versionType":"git","status":"affected"},{"version":"6722e78c90054101e6797d5944cdc81af9897a0a","lessThan":"c4bb894362d224b699e2f95c6c26707d9654e4a3","versionType":"git","status":"affected"},{"version":"6722e78c90054101e6797d5944cdc81af9897a0a","lessThan":"d0fc3dabfe67caf084e7119ceb2ee23f5ad2f2da","versionType":"git","status":"affected"},{"version":"6722e78c90054101e6797d5944cdc81af9897a0a","lessThan":"0c53eb14975f029abd6b26896a460f0d2aaefe6b","versionType":"git","status":"affected"},{"version":"6722e78c90054101e6797d5944cdc81af9897a0a","lessThan":"717137221c7d90e7c98bda9a370c9da6cbf015e5","versionType":"git","status":"affected"},{"version":"6722e78c90054101e6797d5944cdc81af9897a0a","lessThan":"8dc5d98a16fa23c00999aecf10018c9f69fa5bf4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ppp/ppp_async.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.15","status":"affected"},{"version":"0","lessThan":"2.6.15","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.15","versionEndExcluding":"5.10.271","matchCriteriaId":"E40722F7-1496-40A6-AF08-E445B9BB75D6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.222","matchCriteriaId":"71A72718-B484-4334-A55F-4AEF4DC98732"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.1.189","matchCriteriaId":"A08955FE-5938-4F5B-B6A0-BEA8BA740A26"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.158","matchCriteriaId":"4F4B14AC-C632-4A61-9E23-076CC1A04CEA"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.12.111","matchCriteriaId":"25101E3A-E888-4430-B5C5-6D6BC4635597"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.53","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*","matchCriteriaId":"14FD7B9A-4946-4511-8E63-6E13870CD4A8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0c53eb14975f029abd6b26896a460f0d2aaefe6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/25f354c55b8435d1f51b8a0a05a3cfe429358523","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/717137221c7d90e7c98bda9a370c9da6cbf015e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/8dc5d98a16fa23c00999aecf10018c9f69fa5bf4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/a86a17745c3e1c6fadd4d6e90c03552dfe531c8c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/c4bb894362d224b699e2f95c6c26707d9654e4a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d0fc3dabfe67caf084e7119ceb2ee23f5ad2f2da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/ff035780adb0f49dc2c7ada26b4697849a68bec8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98159","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T11:17:47.640","lastModified":"2026-10-19T10:18:16.150","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921: validate CLC firmware records\n\nThe CLC region is supplied by firmware, but the loader trusts the\nregion count and each record length. A malformed image can make the\nregion table pointer precede the firmware buffer, make the record loop\nfail to advance, or index phy->clc past its end. Validate the table and\nrecord bounds before dereferencing or copying."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/mediatek/mt76/mt7921/mcu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"23bdc5d8cadfc941e7782d0cb8afb2d9ae73b125","lessThan":"46673662402884ca55a869e4ebe956e08e8b6b05","versionType":"git","status":"affected"},{"version":"23bdc5d8cadfc941e7782d0cb8afb2d9ae73b125","lessThan":"740272d46ffc8231709a5e774cf5e4a5785b8a02","versionType":"git","status":"affected"},{"version":"23bdc5d8cadfc941e7782d0cb8afb2d9ae73b125","lessThan":"602a950134ee2940136f60797e4457c3983b06ce","versionType":"git","status":"affected"},{"version":"23bdc5d8cadfc941e7782d0cb8afb2d9ae73b125","lessThan":"3896be051e928c891922d91de94c99519d215dff","versionType":"git","status":"affected"},{"version":"23bdc5d8cadfc941e7782d0cb8afb2d9ae73b125","lessThan":"3c505e2af16a9320f4355218394a955fbbc65322","versionType":"git","status":"affected"},{"version":"23bdc5d8cadfc941e7782d0cb8afb2d9ae73b125","lessThan":"9417c5818a0146980c2608fda94c908e604eb033","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/mediatek/mt76/mt7921/mcu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.1.189","matchCriteriaId":"A08955FE-5938-4F5B-B6A0-BEA8BA740A26"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.158","matchCriteriaId":"4F4B14AC-C632-4A61-9E23-076CC1A04CEA"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.12.111","matchCriteriaId":"25101E3A-E888-4430-B5C5-6D6BC4635597"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"6.18.53","matchCriteriaId":"73ACAEE5-4BA8-4054-AF4C-14413FA0192B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2","versionEndExcluding":"7.2.7","matchCriteriaId":"D9F474BB-5197-425C-A9D2-40E492785436"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/3896be051e928c891922d91de94c99519d215dff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/3c505e2af16a9320f4355218394a955fbbc65322","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/46673662402884ca55a869e4ebe956e08e8b6b05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/602a950134ee2940136f60797e4457c3983b06ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/740272d46ffc8231709a5e774cf5e4a5785b8a02","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/9417c5818a0146980c2608fda94c908e604eb033","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-97622","sourceIdentifier":"security@wordfence.com","published":"2026-09-25T12:17:11.423","lastModified":"2026-09-25T12:17:11.423","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-62062. Reason: This candidate is a reservation duplicate of CVE-2026-62062. Notes: All CVE users should reference CVE-2026-62062 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2025-51457","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T13:17:05.613","lastModified":"2026-10-14T13:10:00.187","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands."},{"lang":"es","value":"D-Link DAP-2610 hasta la versión 2.06B08r099 contiene una vulnerabilidad de inyección de comandos autenticada dentro de la interfaz web en el endpoint /index.xgi. Un atacante con acceso autenticado puede explotar algunos parámetros para ejecutar comandos de sistema arbitrarios."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:09:21.326733Z","id":"CVE-2025-51457","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-77"}]}],"references":[{"url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10428","source":"cve@mitre.org"},{"url":"https://www.dlink.com/en/security-bulletin/","source":"cve@mitre.org"},{"url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10428","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51772","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T13:17:14.550","lastModified":"2026-09-30T17:23:08.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted HTTP PATCH request"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T15:56:47.606213Z","id":"CVE-2026-51772","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/sadandbset/CVE-2026-51772-CVE-2026-51773","source":"cve@mitre.org"},{"url":"https://github.com/sadandbset/CVE-2026-51772-CVE-2026-51773/blob/main/CVE-2026-51772.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51773","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T13:17:14.673","lastModified":"2026-09-30T17:23:08.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the _retry_request function fails to validate the destination host before attaching sensitive authentication headers."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:23:29.856212Z","id":"CVE-2026-51773","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/sadandbset/CVE-2026-51772-CVE-2026-51773","source":"cve@mitre.org"},{"url":"https://github.com/sadandbset/CVE-2026-51772-CVE-2026-51773/blob/main/CVE-2026-51773.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-52622","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T13:17:14.787","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:58:37.130439Z","id":"CVE-2026-52622","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://jl-zhenlaixiaowei.blog.csdn.net/article/details/166365472?spm=1001.2014.3001.5502","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-78902","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T13:17:16.170","lastModified":"2026-09-30T17:23:08.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG package"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:47:32.317001Z","id":"CVE-2026-78902","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.netspi.com/blog/technical-blog/web-application-pentesting/cve-2026-78902-xss-to-rce-in-pfsense-with-one-dns-request/","source":"cve@mitre.org"},{"url":"https://www.netspi.com/blog/technical-blog/web-application-pentesting/cve-2026-78902-xss-to-rce-in-pfsense-with-one-dns-request/","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-79153","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T13:17:16.297","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\\SYSTEM on affected systems."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:56:16.579088Z","id":"CVE-2026-79153","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://gist.github.com/Soham-029/b1b52cbf3d10e9f8dd4997c52d1419ad#file-seclore-desktop-client-windows-security-advisory-md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-88420","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T13:17:16.787","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:15:44.873677Z","id":"CVE-2026-88420","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gist.github.com/itsmohitnarayan/89de718efb225e840719478ed949bd51","source":"cve@mitre.org"},{"url":"https://gist.github.com/itsmohitnarayan/89de718efb225e840719478ed949bd51","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88421","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T13:17:16.903","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:45:51.778449Z","id":"CVE-2026-88421","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://gist.github.com/itsmohitnarayan/736225bd6cd79031a5dfbf56acdb14ae","source":"cve@mitre.org"},{"url":"https://gist.github.com/itsmohitnarayan/736225bd6cd79031a5dfbf56acdb14ae","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-95832","sourceIdentifier":"4daa8cea-433a-44bd-9456-53b127fc289a","published":"2026-09-25T13:17:24.063","lastModified":"2026-09-29T21:32:59.833","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in kitty/screen.c then writes the reply to the pseudoterminal master, where it is not distinguishable from input typed by the user, without neutralising it for the shell that reads it. The payload is reduced to printable ASCII before the field name is echoed, which is the restriction introduced in 0.47.3 as the fix for CVE-2026-54057, and the record and field separators ; and = are consumed as delimiters, but every other printable character survives, which is sufficient to compose a shell command. A newline is available from handle_remote_ssh() in kitty/window.py, which writes the bytes yielded by get_ssh_data() in kittens/ssh/utils.py, the first of which begin with a newline, to the pseudoterminal master before any credential carried in the request is checked. The reply is framed as an OSC sequence carrying the escape code number, the field name, and the literal value ?. This results in execution of an attacker-chosen command with the privileges of the user running the terminal."}],"affected":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","affectedData":[{"vendor":"Kovid Goyal","product":"kitty","defaultStatus":"unaffected","programFiles":["kitty/window.py","kitty/screen.c"],"repo":"https://github.com/kovidgoyal/kitty","versions":[{"version":"0.47.3","lessThan":"0.49.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:29:56.732664Z","id":"CVE-2026-95832","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"references":[{"url":"https://github.com/kovidgoyal/kitty/commit/03fbdad855490470233954bc810e517027e5e640","source":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://github.com/kovidgoyal/kitty/commit/57bb144d96c0f9d48a2b0a6d43c9a23d2a091cbf","source":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0","source":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://secur0.com/en/cna/cve-list/cve-2026-95832-kitty-color-control-command-execution","source":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54057","source":"4daa8cea-433a-44bd-9456-53b127fc289a"}]}},{"cve":{"id":"CVE-2026-100070","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T14:17:13.400","lastModified":"2026-10-20T18:19:31.813","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_nat_sip: rewind offset when NAT shrinks the packet\n\nsashiko says:\n If map_addr() changes the packet length, such as when the public NAT IP\n string is shorter or longer than the internal IP, coff will still point to\n the offset relative to the pre-mangled packet.\n If the packet shrinks, coff could overshoot the correct position,\n potentially causing the next ct_sip_parse_header_uri() call to silently\n skip bytes and miss subsequent Contact headers. Could this lead to a\n failure to NAT those subsequent headers and leak internal network details?"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nf_nat_sip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c978cd3a937141deaf7995b849824af6dacdeae7","lessThan":"6828aca3d82717c2fda92af81c0dda642bc2b465","versionType":"git","status":"affected"},{"version":"c978cd3a937141deaf7995b849824af6dacdeae7","lessThan":"2703f5ea8d85bc729f433ac09ee902084c947122","versionType":"git","status":"affected"},{"version":"c978cd3a937141deaf7995b849824af6dacdeae7","lessThan":"0f4d30e2e49f343fc28ba1e259fd22969b940c46","versionType":"git","status":"affected"},{"version":"c978cd3a937141deaf7995b849824af6dacdeae7","lessThan":"810da5a63549531da78348b0a4545042d84e01e2","versionType":"git","status":"affected"},{"version":"c978cd3a937141deaf7995b849824af6dacdeae7","lessThan":"668cc1c30caedc63070b10d17d5514748988a140","versionType":"git","status":"affected"},{"version":"c978cd3a937141deaf7995b849824af6dacdeae7","lessThan":"e70d48fcf8382581162608a4a322919bfd22aef3","versionType":"git","status":"affected"},{"version":"c978cd3a937141deaf7995b849824af6dacdeae7","lessThan":"c408d416618ebb8a95e3097a13f3b793ea9272ee","versionType":"git","status":"affected"},{"version":"c978cd3a937141deaf7995b849824af6dacdeae7","lessThan":"16aecbe3036f6097c26b51b12e4c1cf207769690","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/nf_nat_sip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.26","status":"affected"},{"version":"0","lessThan":"2.6.26","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"5.10.270","matchCriteriaId":"D273F6FF-1AB0-4129-9132-7F2BF91CA53F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.221","matchCriteriaId":"64865F15-53CF-4958-9535-E9EC89C9EDB9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.188","matchCriteriaId":"9731F8D2-153C-4E66-8418-BBD7C3BE0B0D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.157","matchCriteriaId":"F5E6592C-4D9C-4D99-B17A-777E25A031F5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.110","matchCriteriaId":"A19EC695-B7E1-41E5-B0EA-E331EFDA98A9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.52","matchCriteriaId":"0457F732-0EA6-47D3-A69C-17A43B435D23"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.6","matchCriteriaId":"BAFE7055-A65A-44F4-BD4B-BF067EAE17F3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0f4d30e2e49f343fc28ba1e259fd22969b940c46","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/16aecbe3036f6097c26b51b12e4c1cf207769690","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/2703f5ea8d85bc729f433ac09ee902084c947122","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/668cc1c30caedc63070b10d17d5514748988a140","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/6828aca3d82717c2fda92af81c0dda642bc2b465","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/810da5a63549531da78348b0a4545042d84e01e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/c408d416618ebb8a95e3097a13f3b793ea9272ee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e70d48fcf8382581162608a4a322919bfd22aef3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-100071","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T14:17:13.567","lastModified":"2026-10-21T18:46:22.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: free learned nodes on device setup failure\n\nhsr_dev_finalize() can fail after a lower-device RX handler has\nalready been registered (slave A is added before the failable slave B\nand interlink adds). RX handlers run in softirq regardless of the\nmaster's state, so frames received in that window can learn dynamic\nnodes into node_db, and the error unwind never releases them.\n\nFree both owned dynamic databases in the unwind, mirroring\nhsr_dellink(). proxy_node_db is provably empty on every current error\nexit (only interlink RX feeds it, and the interlink add is the last\nfailable step) and is freed for symmetry. The order is safe:\nhsr_del_port() unregisters each RX handler with synchronize_net()\nbefore hsr_del_nodes() runs, which removes remaining entries with\nlist_del_rcu() and defers their release with call_rcu() for readers\nalready under RCU."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/hsr/hsr_device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8","lessThan":"e691eee886871b933d772ffc76d66c80b4c0a25e","versionType":"git","status":"affected"},{"version":"81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8","lessThan":"0a340ffd96943a49a78e367efac9517ca767d99b","versionType":"git","status":"affected"},{"version":"81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8","lessThan":"f7289e3492f2694dccd3d79287e0e31879b58650","versionType":"git","status":"affected"},{"version":"81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8","lessThan":"65702339b3e9fd792f65d4b740928798194d86ce","versionType":"git","status":"affected"},{"version":"81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8","lessThan":"49b01f2939abc676a6f9a118f07a10110ee5f683","versionType":"git","status":"affected"},{"version":"81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8","lessThan":"7f16289b91eb316f170a6bd22d32e6c632f6a5b6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/hsr/hsr_device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.17","status":"affected"},{"version":"0","lessThan":"3.17","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.17","versionEndExcluding":"6.1.188","matchCriteriaId":"BAD8B9E5-FB60-4CC8-A263-40085BAD7E90"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.157","matchCriteriaId":"F5E6592C-4D9C-4D99-B17A-777E25A031F5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.110","matchCriteriaId":"A19EC695-B7E1-41E5-B0EA-E331EFDA98A9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.52","matchCriteriaId":"0457F732-0EA6-47D3-A69C-17A43B435D23"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.6","matchCriteriaId":"BAFE7055-A65A-44F4-BD4B-BF067EAE17F3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0a340ffd96943a49a78e367efac9517ca767d99b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/49b01f2939abc676a6f9a118f07a10110ee5f683","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/65702339b3e9fd792f65d4b740928798194d86ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/7f16289b91eb316f170a6bd22d32e6c632f6a5b6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e691eee886871b933d772ffc76d66c80b4c0a25e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f7289e3492f2694dccd3d79287e0e31879b58650","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-100072","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T14:17:13.700","lastModified":"2026-10-21T18:49:49.167","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: platform: Use acpi_bus_get_primary_device()\n\nThe acpi_get_first_physical_node() usage in acpi_platform_fill_resource()\nand acpi_create_platform_device() is generally unsafe because in theory\nthe device returned by it may be freed at any time [1].\n\nIt is also inefficient because acpi_get_first_physical_node() is called\nmultiple times for the same argument which can be avoided.\n\nAddress these issues by using acpi_bus_get_primary_device() instead of\nacpi_get_first_physical_node() and adjusting the code to call it just\nonce at the beginning of and acpi_create_platform_device() and drop\nthe device reference acquired by it upon the return from that function."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpi_platform.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3b95bd160547f56a68aeb972c33ae9511e7a8380","lessThan":"a75e5de593ef158feb17989bff7730c5a3d82503","versionType":"git","status":"affected"},{"version":"3b95bd160547f56a68aeb972c33ae9511e7a8380","lessThan":"527a497fb2ef77a95170eefe2007e2c4c957bd2c","versionType":"git","status":"affected"},{"version":"3b95bd160547f56a68aeb972c33ae9511e7a8380","lessThan":"c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71","versionType":"git","status":"affected"},{"version":"3b95bd160547f56a68aeb972c33ae9511e7a8380","lessThan":"a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpi_platform.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.6","status":"affected"},{"version":"0","lessThan":"4.6","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"7.2.6","matchCriteriaId":"DD82E339-AFE4-4D6E-AE7F-BC26398AF217"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/527a497fb2ef77a95170eefe2007e2c4c957bd2c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/a75e5de593ef158feb17989bff7730c5a3d82503","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-100073","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T14:17:13.810","lastModified":"2026-10-21T18:57:22.487","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix transaction overflow during writeback\n\nCommit 95ad8ee45cdb (\"ext4: correct the reserved credits for extent\nconversion\") was correct to note that we need to reserve enough credits\nfor all extents possibly underlying a large folio. However it was too\neager to reduce the number of reserved credits. Extent conversion may\nnot only need to touch several leaf extent blocks, it may also need to\nsplit extents - for example a single large unwritten extent may need to\nbe split into many small written ones in case of sparse folio dirtying.\nThis can thus result not only in extent leaf modifications but also in a\nneed to allocate new extent tree nodes. As a result the reserved\ntransaction credits were not sufficient in some corner cases. Use\next4_meta_trans_blocks() for correct upper bound credit estimate."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ext4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"95ad8ee45cdbc321c135a2db895d48b374ef0f87","lessThan":"a22464c5df5827e884a5a7d3d8fb03870e5bb6c8","versionType":"git","status":"affected"},{"version":"95ad8ee45cdbc321c135a2db895d48b374ef0f87","lessThan":"46e8e31771f4f1c5e1cdec37a889a6730e42e9f1","versionType":"git","status":"affected"},{"version":"2b6d39229bc783198222cddd31e2fbded93c8db7","versionType":"git","status":"affected"},{"version":"6.16.3","lessThan":"6.17","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ext4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-617"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16.3","versionEndExcluding":"6.17","matchCriteriaId":"C95204FA-1BF2-43C6-8C61-093C7D754A2D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"7.2.6","matchCriteriaId":"F3E55ED8-96D7-4F13-BF5C-51FF8FBB30D9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/46e8e31771f4f1c5e1cdec37a889a6730e42e9f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/a22464c5df5827e884a5a7d3d8fb03870e5bb6c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-100074","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T14:17:13.973","lastModified":"2026-10-21T13:18:26.940","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark bpf_refcount field as unique\n\nBPF_REFCOUNT is not marked as a unique field, while it should be. Fix\nthis oversight."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/btf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d54730b50bae1f3119bd686d551d66f0fcc387ca","lessThan":"015f9fbcf3382c5eb563a157ee8cabb6fbfcfe5e","versionType":"git","status":"affected"},{"version":"d54730b50bae1f3119bd686d551d66f0fcc387ca","lessThan":"20b3c72c1b83054c568d2322a95e217fdc281bc3","versionType":"git","status":"affected"},{"version":"d54730b50bae1f3119bd686d551d66f0fcc387ca","lessThan":"e42cede6f90177f4f92f80d3de18f628e61d2087","versionType":"git","status":"affected"},{"version":"d54730b50bae1f3119bd686d551d66f0fcc387ca","lessThan":"641f814965d733936ca3618d4d5a12a8fa9be00e","versionType":"git","status":"affected"},{"version":"d54730b50bae1f3119bd686d551d66f0fcc387ca","lessThan":"61e655391cb19c31f94ecd4354f624c81ce4cf75","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/btf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.18.52","matchCriteriaId":"9C6C18F7-53D9-4D9A-8F89-C81548A57ADF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.6","matchCriteriaId":"BAFE7055-A65A-44F4-BD4B-BF067EAE17F3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/015f9fbcf3382c5eb563a157ee8cabb6fbfcfe5e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/20b3c72c1b83054c568d2322a95e217fdc281bc3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61e655391cb19c31f94ecd4354f624c81ce4cf75","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/641f814965d733936ca3618d4d5a12a8fa9be00e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e42cede6f90177f4f92f80d3de18f628e61d2087","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-100075","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T14:17:14.163","lastModified":"2026-10-19T09:17:06.060","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/ulp/srpt/ib_srpt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b99f8e4d7bcd3bfbb3cd965918523299370d0cb2","lessThan":"af00051dbc9f467d4840ec709680660a3f8990fa","versionType":"git","status":"affected"},{"version":"b99f8e4d7bcd3bfbb3cd965918523299370d0cb2","lessThan":"717ab4d0614e9446bf8e2de6229464499e4008d6","versionType":"git","status":"affected"},{"version":"b99f8e4d7bcd3bfbb3cd965918523299370d0cb2","lessThan":"f1f2252da52cdda912da9993f39f58783b01b38f","versionType":"git","status":"affected"},{"version":"b99f8e4d7bcd3bfbb3cd965918523299370d0cb2","lessThan":"f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d","versionType":"git","status":"affected"},{"version":"b99f8e4d7bcd3bfbb3cd965918523299370d0cb2","lessThan":"be1478849e1abb1e12dc12e14cdbf800cc6fa99a","versionType":"git","status":"affected"},{"version":"b99f8e4d7bcd3bfbb3cd965918523299370d0cb2","lessThan":"af073bd245180393bcb15d33d3990a6bdc32593a","versionType":"git","status":"affected"},{"version":"b99f8e4d7bcd3bfbb3cd965918523299370d0cb2","lessThan":"bd02d644bd19a2795c018635d273d91e45d2bb95","versionType":"git","status":"affected"},{"version":"b99f8e4d7bcd3bfbb3cd965918523299370d0cb2","lessThan":"b38f98e176050850f41bb6415f3a71400056623e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/ulp/srpt/ib_srpt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.10.270","matchCriteriaId":"B1423232-792C-4A9B-8C80-D8B42060E015"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.221","matchCriteriaId":"64865F15-53CF-4958-9535-E9EC89C9EDB9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.188","matchCriteriaId":"9731F8D2-153C-4E66-8418-BBD7C3BE0B0D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.157","matchCriteriaId":"F5E6592C-4D9C-4D99-B17A-777E25A031F5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.110","matchCriteriaId":"A19EC695-B7E1-41E5-B0EA-E331EFDA98A9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.52","matchCriteriaId":"0457F732-0EA6-47D3-A69C-17A43B435D23"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.6","matchCriteriaId":"BAFE7055-A65A-44F4-BD4B-BF067EAE17F3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-100076","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T14:17:14.440","lastModified":"2026-10-21T13:18:27.140","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths\n\nissue_beacon(), issue_probersp() and issue_asocrsp() obtain a management\nxmit_frame together with its xmit_buf from the driver's fixed-size\nmanagement-TX pools via alloc_mgtxmitframe(). On the normal path the frame\nis handed to dump_mgntframe(), which transfers ownership and eventually\nreturns both objects to their pools (the frame and, for beacons, the buf\nin rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion\npath).\n\nSeveral error/edge paths return early after a successful\nalloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never\ntransferred and neither object is freed:\n\n  - issue_beacon(): beacon larger than 512 bytes\n  - issue_probersp(): cur_network->ie_length > MAX_IE_SZ\n  - issue_probersp(): kzalloc() of the SSID scratch buffer fails\n  - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP\n\nBecause alloc_mgtxmitframe() removes the frame and buf from their free\nlists (list_del_init) without placing them on any pending list, an\norphaned pair is on no list and referenced by nobody, so it is only\nreclaimed at driver teardown. Repeated hits progressively exhaust the\nmanagement-TX pools until alloc_mgtxmitframe() returns NULL and the\ninterface can no longer send beacons or probe/assoc responses.\n\nFree the frame and buffer on these paths, matching the existing correct\nerror handling in issue_assocreq()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"17260b5215d4ced17a733e2c027a76290e476fad","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"2f5e2752c2b4bad01df4523cfe2b41b702c60f00","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"6c9f6a3b9fdd31a0836b681053155b5997c0156e","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"c48e5aa01525577d6b6e782962a5bfb0e1535cb5","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"41b8209376dffbd7b0b85c8bc4697d9166ac62ef","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-401"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.18.52","matchCriteriaId":"D970B695-AC3D-418F-8B5C-84798994EBE9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.6","matchCriteriaId":"BAFE7055-A65A-44F4-BD4B-BF067EAE17F3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/17260b5215d4ced17a733e2c027a76290e476fad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2f5e2752c2b4bad01df4523cfe2b41b702c60f00","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41b8209376dffbd7b0b85c8bc4697d9166ac62ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/6c9f6a3b9fdd31a0836b681053155b5997c0156e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/c48e5aa01525577d6b6e782962a5bfb0e1535cb5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-100077","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T14:17:14.593","lastModified":"2026-10-21T13:18:27.353","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Recover HW before retire hung submit\n\nDuring recovery, it is not safe to retire the hung submit before we\nrecover the GPU. Retiring the submit triggers BO free and that can\nresult in GPU pagefaults since the GPU may be actively accessing those\nBOs.\n\nTo fix this, retire the submits after gpu recovery is complete in\nrecover_worker().\n\nPatchwork: https://patchwork.freedesktop.org/patch/730655/"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/msm/msm_gpu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5","lessThan":"d4bee74b7cb93e40c60b43dc9dc0c3aab444649f","versionType":"git","status":"affected"},{"version":"1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5","lessThan":"2f021d93f15829ba052ff22bc40df0ec3ae7c7ab","versionType":"git","status":"affected"},{"version":"1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5","lessThan":"e36284257eeca13768687bf8e52f66f8ea0e8794","versionType":"git","status":"affected"},{"version":"1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5","lessThan":"dc64cf9d71428234389b635d142cb5fe07d57eab","versionType":"git","status":"affected"},{"version":"1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5","lessThan":"b303e1d52811de7d1bcf793560754d4df68d4a1c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/msm/msm_gpu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.18.52","matchCriteriaId":"91744612-1EE4-45B1-B38B-CA048AA96F27"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.6","matchCriteriaId":"BAFE7055-A65A-44F4-BD4B-BF067EAE17F3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/2f021d93f15829ba052ff22bc40df0ec3ae7c7ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b303e1d52811de7d1bcf793560754d4df68d4a1c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d4bee74b7cb93e40c60b43dc9dc0c3aab444649f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc64cf9d71428234389b635d142cb5fe07d57eab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e36284257eeca13768687bf8e52f66f8ea0e8794","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-100078","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T14:17:14.740","lastModified":"2026-10-19T09:17:06.590","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mei: pass correct argument to function\n\nThe first argument to iwl_mei_write_cyclic_buf() should be the cldev\nbut the q_head pointer is passed instead. Fix it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mei/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"652291601459272d52b6ba12811f0b60b3e6444f","lessThan":"034445e19f12bb8771c58e2ecf1fbd6eac9b5fac","versionType":"git","status":"affected"},{"version":"652291601459272d52b6ba12811f0b60b3e6444f","lessThan":"f22ad9d1077c83718d9e6c84b71726287c1d1ad3","versionType":"git","status":"affected"},{"version":"652291601459272d52b6ba12811f0b60b3e6444f","lessThan":"ee91ae7f5815345612d8c0afd5d7efed361bcdb5","versionType":"git","status":"affected"},{"version":"652291601459272d52b6ba12811f0b60b3e6444f","lessThan":"6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3","versionType":"git","status":"affected"},{"version":"652291601459272d52b6ba12811f0b60b3e6444f","lessThan":"082b353c05b8eaf07e03fc1918c176cd3c216e25","versionType":"git","status":"affected"},{"version":"652291601459272d52b6ba12811f0b60b3e6444f","lessThan":"905f57aefde4f4092a411c8a55856182fb1c7598","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mei/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.17","status":"affected"},{"version":"0","lessThan":"5.17","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17","versionEndExcluding":"6.1.188","matchCriteriaId":"3D235106-73C8-415C-B5AA-9B4A1CBA6741"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.157","matchCriteriaId":"F5E6592C-4D9C-4D99-B17A-777E25A031F5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.110","matchCriteriaId":"A19EC695-B7E1-41E5-B0EA-E331EFDA98A9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.52","matchCriteriaId":"0457F732-0EA6-47D3-A69C-17A43B435D23"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.6","matchCriteriaId":"BAFE7055-A65A-44F4-BD4B-BF067EAE17F3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/034445e19f12bb8771c58e2ecf1fbd6eac9b5fac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/082b353c05b8eaf07e03fc1918c176cd3c216e25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/905f57aefde4f4092a411c8a55856182fb1c7598","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/ee91ae7f5815345612d8c0afd5d7efed361bcdb5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f22ad9d1077c83718d9e6c84b71726287c1d1ad3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-100079","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T14:17:15.000","lastModified":"2026-10-19T09:17:06.757","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: unregister debugfs entries on teardown\n\nucsi_register() creates per-instance debugfs entries, but\nucsi_unregister() keeps them around until ucsi_destroy().\n\nDrivers like ucsi_glink that unregister/register the same UCSI\ninstance across remoteproc restart then try to create an already\nexisting debugfs directory and log:\n\n  debugfs: 'pmic_glink.ucsi.0' already exists in 'ucsi'\n\nUnregister debugfs entries as part of ucsi_unregister(), and\nclear ucsi->debugfs after freeing it so repeated unregister\npaths remain safe."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/typec/ucsi/debugfs.c","drivers/usb/typec/ucsi/ucsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"df0383ffad64dc09954a60873c1e202b47f08d90","lessThan":"fb7393519908befdc094be4ea913f582adbf2f7c","versionType":"git","status":"affected"},{"version":"df0383ffad64dc09954a60873c1e202b47f08d90","lessThan":"7177c215e69658adbd2f2fc5b72e14be9208d2ba","versionType":"git","status":"affected"},{"version":"df0383ffad64dc09954a60873c1e202b47f08d90","lessThan":"1f44d001620fd3caa30619a9bc73e9d15555408b","versionType":"git","status":"affected"},{"version":"df0383ffad64dc09954a60873c1e202b47f08d90","lessThan":"62efee351566321ad72a4abaf6eb7d972590585d","versionType":"git","status":"affected"},{"version":"df0383ffad64dc09954a60873c1e202b47f08d90","lessThan":"eed73a65ab609b79d53de88cccc34b36dfe753c4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/typec/ucsi/debugfs.c","drivers/usb/typec/ucsi/ucsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-772"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.157","matchCriteriaId":"E7B3238E-F896-4651-B55B-440AFF545ADF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.110","matchCriteriaId":"A19EC695-B7E1-41E5-B0EA-E331EFDA98A9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.52","matchCriteriaId":"0457F732-0EA6-47D3-A69C-17A43B435D23"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.6","matchCriteriaId":"BAFE7055-A65A-44F4-BD4B-BF067EAE17F3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1f44d001620fd3caa30619a9bc73e9d15555408b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/62efee351566321ad72a4abaf6eb7d972590585d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/7177c215e69658adbd2f2fc5b72e14be9208d2ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/eed73a65ab609b79d53de88cccc34b36dfe753c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/fb7393519908befdc094be4ea913f582adbf2f7c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-100172","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-25T14:17:15.353","lastModified":"2026-09-25T16:17:24.227","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. In both templates, dynamic values associated with this content, including icon color, icon style, icon glyph, subtype, identifier, name, description, and matched value, are interpolated directly into the data-content HTML attribute of Bootstrap popover elements without appropriate output encoding. Because the popovers are configured with data-html=\"true\", the content is interpreted as HTML in the victim's browser. An authenticated attacker who can influence matched, tracked, or tagged content may inject arbitrary HTML or JavaScript into these values. When a victim displays the affected popover, the injected markup may execute in the victim's session, potentially enabling data exfiltration or actions with the victim's privileges. The vulnerability is classified as stored XSS because the malicious payload can persist in the affected match, tracking, or tag-related data and be delivered to users who view the affected content."}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"ail project","product":"ail framework","modules":["chats_explorer (block_message.html)","objects/item (show_item.html)"],"programFiles":["var/www/templates/chats_explorer/block_message.html","var/www/templates/objects/item/show_item.html"],"repo":"https://github.com/ail-project/ail-framework","versions":[{"version":"unspecified","lessThan":"7.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:15:12.313075Z","id":"CVE-2026-100172","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-100174","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-25T14:17:16.783","lastModified":"2026-09-25T16:17:24.433","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS). A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers (e.g., <img src=x onerror=alert(1)> or <svg onload=...>) in the tag name. When another authenticated user opened a page containing the tag selector, the malicious tag name was inserted into the DOM using jQuery's html property, causing the embedded script to execute in the victim's browser context.\n\nThe vulnerable code paths affected both the suggestion/combo-item rendering (_renderComboItems) and the selected-tag rendering logic. In both cases, the display value derived from the tag's displayField was passed directly to the html property of a jQuery element constructor, which parses and inserts the string as raw HTML rather than as text.\n\nPreconditions: the attacker must have an authenticated account with permission to create custom tags, and the victim must be an authenticated user who views a page that renders the tag selector with the attacker's stored tag. The attack is stored (persistent) and does not require the victim to perform any action beyond loading the page.\n\nSecurity impact: successful exploitation allows arbitrary JavaScript execution in the victim's browser within the application's origin, potentially leading to session hijacking, unauthorized data access, form manipulation, or further client-side attacks."}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"ail project","product":"ail framework","modules":["tag selector (tags.js)"],"programFiles":["var/www/static/js/tags.js"],"repo":"https://github.com/ail-project/ail-framework","versions":[{"version":"0","lessThan":"7.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:14:24.607198Z","id":"CVE-2026-100174","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/ail-project/ail-framework/commit/b2d0ed05f6cf79b2312a3f1f923d0d1a5d7a9edb","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-100176","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-25T14:17:17.020","lastModified":"2026-09-25T15:17:52.300","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames into the DOM using D3's html() method in the tooltip. Because the username value (d.obj) is interpolated directly into an HTML string without sanitization, a crafted username containing HTML event handlers (e.g., <img src=x onerror=alert(1)>) will execute arbitrary JavaScript in the analyst's browser when the analyst hovers over the corresponding timeline entry. The attack requires the victim to be an authenticated analyst with access to the timeline view and to interact with the malicious timeline entry (hover). Successful exploitation can lead to session hijacking, data exfiltration, or unauthorized actions performed within the analyst's authenticated session. The vulnerability resides in the client-side JavaScript file var/www/static/js/d3/timeline_basic.js."}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"ail project","product":"ail framework","modules":["username timeline (D3 timeline_basic)"],"programFiles":["var/www/static/js/d3/timeline_basic.js"],"repo":"https://github.com/ail-project/ail-framework","versions":[{"version":"unspecified","lessThan":"7.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T14:56:38.970855Z","id":"CVE-2026-100176","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/ail-project/ail-framework/commit/455dd92c4179c53204368d93681ded4b57e31643","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-100177","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-25T14:17:17.223","lastModified":"2026-09-25T15:17:52.523","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared the cookiejar's owning user ID to the requesting user ID. It did not validate organizational boundaries, did not account for the requesting user's role. When the cookiejar level was not 0, no access check was performed at all. An authenticated user could therefore reference another organization's cookiejar by UUID and have the crawler use that organization's stored cookies (session tokens, authentication credentials) when performing web crawls, effectively leaking or exfiltrating the victim organization's session data.\n\n\nThe vulnerability requires an authenticated user with the ability to create crawler tasks. The attacker must know or guess a valid cookiejar UUID belonging to another organization. The impact is unauthorized access to another organization's stored cookies and session data through the crawler infrastructure."}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"ail project","product":"ail framework","modules":["bin/lib/crawlers.py","var/www/blueprints/api_rest.py","var/www/blueprints/crawler_splash.py"],"programFiles":["bin/lib/crawlers.py","var/www/blueprints/api_rest.py","var/www/blueprints/crawler_splash.py"],"repo":"https://github.com/ail-project/ail-framework","versions":[{"version":"unspecified","lessThan":"7.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T14:55:38.429027Z","id":"CVE-2026-100177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/ail-project/ail-framework/commit/3773ca36658c57ce592aebe74e27c855eb64f58a","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-100187","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-25T14:17:17.440","lastModified":"2026-09-25T15:17:52.753","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (exactly 69 characters) and a suffix check (ending in \".onion\"), without performing proper hostname parsing or onion-domain validation. An unauthenticated attacker who could publish or control web content crawled by the framework could embed a crafted URL containing an IP address or non-onion hostname with a path ending in \".onion\" that satisfied the length and suffix conditions. Such a URL would be extracted, its domain naively sliced from the string, and queued as a legitimate onion crawler task. This allowed unauthenticated content publishers to inject arbitrary non-onion targets into the crawler's task queue, influencing crawler behavior and potentially directing it toward unintended network resources. The vulnerability required no authentication, no user interaction, and only the ability to place crafted content in a location the framework would crawl. The security impact is a loss of integrity in the crawler's target selection: the framework processes and acts upon URLs that do not correspond to legitimate .onion services."}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"ail project","product":"ail framework","modules":["Onion module"],"programFiles":["bin/modules/Onion.py"],"repo":"https://github.com/ail-project/ail-framework","versions":[{"version":"unspecified","lessThan":"7.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T14:45:47.206440Z","id":"CVE-2026-100187","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/ail-project/ail-framework/commit/5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-100190","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-25T14:17:17.643","lastModified":"2026-09-25T17:17:05.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS). User-supplied data originating from imported crawler captures—specifically item IDs, URLs, and screenshot file paths—was interpolated directly into inline JavaScript contexts within the HTML template. This included an onclick attribute that embedded raw screenshot and URL values into a JavaScript function call, and an inline script block that assigned a screenshot value to a JavaScript variable without escaping. An attacker with a user-role API client could craft a malicious crawler capture import containing JavaScript payloads in these fields. When any user (including privileged users) subsequently viewed the affected domain page, the injected script would execute in the victim's browser context, potentially allowing session hijacking, data exfiltration, or unauthorized actions on behalf of the victim. The vulnerability is stored in the application's data layer and triggered upon page rendering, requiring no further interaction beyond loading the domain view."}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"ail project","product":"ail framework","defaultStatus":"unaffected","modules":["crawler/crawler_splash"],"programFiles":["var/www/templates/crawler/crawler_splash/showDomain.html"],"repo":"https://github.com/ail-project/ail-framework","versions":[{"version":"unspecified","lessThan":"7.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:13:08.012327Z","id":"CVE-2026-100190","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/ail-project/ail-framework/commit/31376ee3d04519c898bb9b3671453a41c4117340","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-80430","sourceIdentifier":"4daa8cea-433a-44bd-9456-53b127fc289a","published":"2026-09-25T14:17:19.067","lastModified":"2026-09-29T21:32:59.833","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdir_data_for_drag() in kitty/dnd.c resolves a descendant of the staged item tree by constructing a path string and opening it with safe_open(path, O_DIRECTORY | O_RDONLY, 0) rather than by walking the tree one component at a time, so a client that declares two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causes mkdirat() to fail with EEXIST, which the code ignores, and causes the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory, which is then passed as the dirfd argument to add_payload() and used for every further create operation on that item and its descendants. Entry names are sanitised against path separators and dot components, but symlink targets are not validated. Files are created with O_CREAT | O_WRONLY | O_EXCL at mode 0644, so existing files cannot be overwritten, and directories are created with mkdirat() at mode 0755, so the attacker can create intermediate directories that did not previously exist. This results in the creation of files and directories at any path writable by the user running kitty, provided the symlink target is an existing directory."}],"affected":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","affectedData":[{"vendor":"Kovid Goyal","product":"kitty","defaultStatus":"unaffected","programFiles":["kitty/dnd.c"],"repo":"https://github.com/kovidgoyal/kitty","versions":[{"version":"0.47.0","lessThan":"0.49.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:27:29.989878Z","id":"CVE-2026-80430","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"references":[{"url":"https://github.com/kovidgoyal/kitty/commit/3c3133d3399257492347f535d8d191680803b25d","source":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://github.com/kovidgoyal/kitty/commit/554908ed0b4d010cf9821c75449c7f7c79a6170a","source":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0","source":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://secur0.com/en/cna/cve-list/cve-2026-80430-kitty-dnd-symlink-traversal","source":"4daa8cea-433a-44bd-9456-53b127fc289a"}]}},{"cve":{"id":"CVE-2026-80431","sourceIdentifier":"4daa8cea-433a-44bd-9456-53b127fc289a","published":"2026-09-25T14:17:19.253","lastModified":"2026-09-29T21:32:59.833","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without any capacity check, while lc is declared by the RAII_ListOfChars macro as a four-element char_type array in the function's stack frame, so an OSC 66 escape code whose payload carries a grapheme cluster longer than four codepoints writes beyond that buffer, one 32-bit value per additional codepoint, in the order the codepoints appear. Where the cluster is preceded in the same payload by a sequence that causes an intermediate flush, the buffer is first migrated to the heap by ensure_space_for_chars() and the write occurs past the heap allocation instead. This results in termination of the kitty process and therefore of all its windows, tabs and child processes."}],"affected":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","affectedData":[{"vendor":"Kovid Goyal","product":"kitty","defaultStatus":"unaffected","programFiles":["kitty/screen.c"],"repo":"https://github.com/kovidgoyal/kitty","versions":[{"version":"0.40.0","lessThan":"0.49.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:05:06.462333Z","id":"CVE-2026-80431","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/kovidgoyal/kitty/commit/7d2fbaadcc2b1eeeef89bd875ec622b42362574b","source":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0","source":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://secur0.com/en/cna/cve-list/cve-2026-80431-kitty-text-sizing-out-of-bounds-write","source":"4daa8cea-433a-44bd-9456-53b127fc289a"}]}},{"cve":{"id":"CVE-2026-84884","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-25T14:17:19.770","lastModified":"2026-10-20T19:03:18.383","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Guardium Data Protection","cpes":["cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:guardium_data_protection:12.2.0:*:*:*:*:*:*:*"],"versions":[{"version":"12.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T03:55:47.200811Z","id":"CVE-2026-84884","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-256"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:guardium_data_protection:12.1:*:*:*:*:*:*:*","matchCriteriaId":"EADF2641-F8DF-4986-8106-287C615DE19D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*","matchCriteriaId":"CBA75153-5681-40C8-8EB4-236EF2EC8A4B"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288035","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-84893","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-25T14:17:19.913","lastModified":"2026-10-20T18:57:08.100","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Guardium Data Protection","cpes":["cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:guardium_data_protection:12.2.0:*:*:*:*:*:*:*"],"versions":[{"version":"12.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T14:25:18.707832Z","id":"CVE-2026-84893","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:guardium_data_protection:12.1:*:*:*:*:*:*:*","matchCriteriaId":"EADF2641-F8DF-4986-8106-287C615DE19D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*","matchCriteriaId":"CBA75153-5681-40C8-8EB4-236EF2EC8A4B"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288035","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-85029","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-25T14:17:20.050","lastModified":"2026-10-20T18:55:31.613","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to improper limitation of a pathname to a restricted directory."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Guardium Data Protection","cpes":["cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:guardium_data_protection:12.2.0:*:*:*:*:*:*:*"],"versions":[{"version":"12.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T03:55:47.885059Z","id":"CVE-2026-85029","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:guardium_data_protection:12.1:*:*:*:*:*:*:*","matchCriteriaId":"EADF2641-F8DF-4986-8106-287C615DE19D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*","matchCriteriaId":"CBA75153-5681-40C8-8EB4-236EF2EC8A4B"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288034","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-85542","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-25T14:17:20.193","lastModified":"2026-10-20T18:57:52.177","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution with elevated privileges on the Central Manager."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Guardium Data Protection","cpes":["cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:guardium_data_protection:12.2.0:*:*:*:*:*:*:*"],"versions":[{"version":"12.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T00:00:00+00:00","id":"CVE-2026-85542","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:guardium_data_protection:12.1:*:*:*:*:*:*:*","matchCriteriaId":"EADF2641-F8DF-4986-8106-287C615DE19D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*","matchCriteriaId":"CBA75153-5681-40C8-8EB4-236EF2EC8A4B"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288035","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-85750","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T14:17:20.330","lastModified":"2026-09-25T15:17:56.560","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, the Imagick support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution, depending on configuration. This has been patched in 16.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Piwigo","product":"Piwigo","versions":[{"version":"<= 16.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T14:38:16.238956Z","id":"CVE-2026-85750","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-j9q6-q52g-g8jw","source":"security-advisories@github.com"},{"url":"https://www.helx.io/en/blog/advisory-piwigo","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-j9q6-q52g-g8jw","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-93641","sourceIdentifier":"cve@rapid7.com","published":"2026-09-25T14:17:23.290","lastModified":"2026-09-29T21:29:07.663","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Zimbra","product":"Zimbra Collaboration Suite (ZCS)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.1.21","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:11:26.334455Z","id":"CVE-2026-93641","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-93642","sourceIdentifier":"cve@rapid7.com","published":"2026-09-25T14:17:23.423","lastModified":"2026-09-29T21:29:07.663","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Zimbra","product":"Zimbra Collaboration Suite (ZCS)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.1.21","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:10:41.974488Z","id":"CVE-2026-93642","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-93643","sourceIdentifier":"cve@rapid7.com","published":"2026-09-25T14:17:23.550","lastModified":"2026-09-29T21:29:07.663","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Zimbra","product":"Zimbra Collaboration Suite (ZCS)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.1.21","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T00:00:00+00:00","id":"CVE-2026-93643","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-93647","sourceIdentifier":"cve@rapid7.com","published":"2026-09-25T14:17:23.673","lastModified":"2026-09-29T21:29:07.663","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Zimbra","product":"Zimbra Collaboration Suite (ZCS)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.1.21","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T03:55:49.181484Z","id":"CVE-2026-93647","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-93834","sourceIdentifier":"secalert@redhat.com","published":"2026-09-25T14:17:24.063","lastModified":"2026-09-29T21:29:07.663","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"qemu-kvm","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"qemu-kvm","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"qemu-kvm","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"qemu-kvm-ma","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"virt-devel:rhel/qemu-kvm","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"virt:rhel/qemu-kvm","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"qemu-kvm","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux for NVIDIA 26","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"qemu-kvm","cpes":["cpe:/a:redhat:enterprise_linux_nvidia:"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 13 (Queens)","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"qemu-kvm-rhev","cpes":["cpe:/a:redhat:openstack:13"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:49:32.754375Z","id":"CVE-2026-93834","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Primary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-93834","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537939","source":"secalert@redhat.com"},{"url":"https://gitlab.com/qemu-project/qemu/-/work_items/4491","source":"secalert@redhat.com"},{"url":"https://gitlab.com/qemu-project/qemu/-/work_items/4491","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97222","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-25T14:17:25.580","lastModified":"2026-09-30T19:38:27.293","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can dereference a freed sheet-object component, causing Gnumeric to crash."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"vendor":"GNOME","product":"Gnumeric","defaultStatus":"unaffected","collectionURL":"https://gitlab.gnome.org/GNOME/gnumeric","packageName":"gnumeric","versions":[{"version":"1.11.0","lessThan":"*","versionType":"semver","status":"affected"},{"version":"bc1dee29525933994181fb2307d6ad584de6040d","versionType":"git","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:14:42.858538Z","id":"CVE-2026-97222","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-97222","source":"patrick@puiterwijk.org"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2541397","source":"patrick@puiterwijk.org"},{"url":"https://gitlab.gnome.org/GNOME/gnumeric/-/issues/897","source":"patrick@puiterwijk.org"}]}},{"cve":{"id":"CVE-2026-97864","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T14:17:27.217","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/units_add_blockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 31.0.00 is sufficient to fix this issue. The identifier of the patch is 07e719368eae8dfb4e22e19424ceab6074164ebc. It is recommended to upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"GibbonEdu","product":"Gibbon","cpes":["cpe:2.3:a:gibbonedu:gibbon:*:*:*:*:*:*:*:*"],"modules":["Unit Planner"],"versions":[{"version":"30.0.01","status":"affected"},{"version":"31.0.00","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:51:51.651002Z","id":"CVE-2026-97864","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/GibbonEdu/core/commit/07e719368eae8dfb4e22e19424ceab6074164ebc","source":"cna@vuldb.com"},{"url":"https://github.com/GibbonEdu/core/compare/v31.0.00","source":"cna@vuldb.com"},{"url":"https://github.com/GibbonEdu/core/pull/2090","source":"cna@vuldb.com"},{"url":"https://github.com/GibbonEdu/core/pull/2095","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97864","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/911004","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409878","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409878/cti","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/911004","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97865","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T14:17:27.423","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The patch is named 78c1222ec0e2119d84684032da1541120a2cdd23. The affected component should be upgraded."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"Open-Web-Analytics","cpes":["cpe:2.3:a:open-web-analytics:open-web-analytics:*:*:*:*:*:*:*:*"],"modules":["Remote Event Queue Endpoint"],"versions":[{"version":"1.8.0","status":"affected"},{"version":"1.8.1","status":"affected"},{"version":"1.8.2","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T13:45:08.444276Z","id":"CVE-2026-97865","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/Open-Web-Analytics/Open-Web-Analytics/","source":"cna@vuldb.com"},{"url":"https://github.com/Open-Web-Analytics/Open-Web-Analytics/commit/78c1222ec0e2119d84684032da1541120a2cdd23","source":"cna@vuldb.com"},{"url":"https://github.com/Open-Web-Analytics/Open-Web-Analytics/issues/960","source":"cna@vuldb.com"},{"url":"https://github.com/Open-Web-Analytics/Open-Web-Analytics/pull/967","source":"cna@vuldb.com"},{"url":"https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.8.2","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97865","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/911108","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409882","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409882/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-98160","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T14:17:27.627","lastModified":"2026-10-19T10:18:16.280","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()\n\npadapter->HalData is allocated via vzalloc(), but incorrectly freed\nusing kfree() in the rtw_sdio_if1_init() error path. Using kfree() to\nrelease this vmalloc-backed buffer can lead to memory corruption.\n\nUse rtw_hal_data_deinit() to pair the free correctly and free\nHalData with vfree().\n\nThe bug was first flagged by an experimental static analysis tool we\nare developing for kernel memory-management bugs. Manual inspection\nconfirms that the issue is still present in current mainline.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have\nsuitable RTL8723BS SDIO hardware to test with, no runtime testing was\nable to be performed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/rtl8723bs/os_dep/sdio_intf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"ff6d1ba247b5c62bdb678f1069abc86ad88a1402","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"d6158333d630a1b21d8914feaf77a6f5deb185d9","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"6c017ab2b0e1b60b5be94636c94720347213d78b","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"4520d673d49dabfd42c008a33889251025f7d6d5","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"423574feaed192063ef0cd0813fb85425f39e539","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"737c928ff5092d7e55128a232c231248fc993777","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"911190f0b9511c3c81f2f2484414c1ae26f636b3","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"264676418b726baca7be49171e306b6aa05cceb0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/rtl8723bs/os_dep/sdio_intf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-763"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"5.10.270","matchCriteriaId":"A90A101C-75E0-477B-AADD-AFC617C1616D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.221","matchCriteriaId":"64865F15-53CF-4958-9535-E9EC89C9EDB9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.188","matchCriteriaId":"9731F8D2-153C-4E66-8418-BBD7C3BE0B0D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.157","matchCriteriaId":"F5E6592C-4D9C-4D99-B17A-777E25A031F5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.110","matchCriteriaId":"A19EC695-B7E1-41E5-B0EA-E331EFDA98A9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.52","matchCriteriaId":"0457F732-0EA6-47D3-A69C-17A43B435D23"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.6","matchCriteriaId":"BAFE7055-A65A-44F4-BD4B-BF067EAE17F3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/264676418b726baca7be49171e306b6aa05cceb0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/423574feaed192063ef0cd0813fb85425f39e539","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/4520d673d49dabfd42c008a33889251025f7d6d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/6c017ab2b0e1b60b5be94636c94720347213d78b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/737c928ff5092d7e55128a232c231248fc993777","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/911190f0b9511c3c81f2f2484414c1ae26f636b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d6158333d630a1b21d8914feaf77a6f5deb185d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/ff6d1ba247b5c62bdb678f1069abc86ad88a1402","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-98161","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T14:17:27.770","lastModified":"2026-10-21T13:21:24.663","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: pmem: keep PREFLUSH before data writes\n\npmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the\nbio data and can later overwrite the error with a successful REQ_FUA flush.\nThat lets data writes run after a failed preflush and can complete the bio\nsuccessfully despite the failed ordering barrier.\n\nRun the REQ_PREFLUSH flush synchronously before touching the bio data and\ncomplete the bio with the flush error if it fails. Keep asynchronous flush\nchaining for REQ_FUA. At that point, data copy has completed and the parent\nbio can wait for the chained flush bio."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/nvdimm/pmem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c5d4355d10d414a96ca870b731756b89d068d57a","lessThan":"22d1f4dcdc9c6d0295c6db0c8933126098b14e05","versionType":"git","status":"affected"},{"version":"c5d4355d10d414a96ca870b731756b89d068d57a","lessThan":"d34c30bc994328d9cf6749b2e9a32aabd08fd076","versionType":"git","status":"affected"},{"version":"c5d4355d10d414a96ca870b731756b89d068d57a","lessThan":"770a90c2127220f0fc194ce909ad4f0842e141cb","versionType":"git","status":"affected"},{"version":"c5d4355d10d414a96ca870b731756b89d068d57a","lessThan":"72561ca1ab96f0f0f32737a6171641e05a318538","versionType":"git","status":"affected"},{"version":"c5d4355d10d414a96ca870b731756b89d068d57a","lessThan":"c644a2f8fef5618fcf453c591177700fd07dd024","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/nvdimm/pmem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-754"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.18.52","matchCriteriaId":"C610B7B2-2897-4305-8DD9-D67F94393609"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.6","matchCriteriaId":"BAFE7055-A65A-44F4-BD4B-BF067EAE17F3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/22d1f4dcdc9c6d0295c6db0c8933126098b14e05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72561ca1ab96f0f0f32737a6171641e05a318538","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/770a90c2127220f0fc194ce909ad4f0842e141cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/c644a2f8fef5618fcf453c591177700fd07dd024","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d34c30bc994328d9cf6749b2e9a32aabd08fd076","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98162","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-25T14:17:27.887","lastModified":"2026-10-21T13:21:24.797","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: fix tree connection leak in smb2_tree_connect()\n\nSee the procedure below:\n\n  smb2_tree_connect\n    ksmbd_tree_conn_connect\n      xa_store(&sess->tree_conns, tree_conn->id, tree_conn)\n      ksmbd_counter_inc(KSMBD_COUNTER_TREE_CONNS)\n      ksmbd_share_tree_conn_inc(sc)\n    ksmbd_iov_pin_rsp // fail\n    status.ret = KSMBD_TREE_CONN_STATUS_NOMEM\n    // do not disconnect tree_conn\n\nDisconnect the new tree connection if ksmbd_iov_pin_rsp() fails."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","lessThan":"fa0c45986fc60b3edfb35879f2fb0eacc0e49e98","versionType":"git","status":"affected"},{"version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","lessThan":"fea9c705bbc618ba6426424c9f8330555820c9ec","versionType":"git","status":"affected"},{"version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","lessThan":"a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc","versionType":"git","status":"affected"},{"version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","lessThan":"39f2032096715daae5f6fd0f587ca7a474b019df","versionType":"git","status":"affected"},{"version":"f2283680a80571ca82d710bc6ecd8f8beac67d63","versionType":"git","status":"affected"},{"version":"9f297df20d93411c0b4ddad7f88ba04a7cd36e77","versionType":"git","status":"affected"},{"version":"5.15.145","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.71","lessThan":"6.2","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-401"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.145","versionEndExcluding":"5.16","matchCriteriaId":"B98C9201-BF17-4E2C-84FF-75EE2AA94DC5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.71","versionEndExcluding":"6.2","matchCriteriaId":"163E72B5-0F5D-49E2-AAEA-F11E02D730AD"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.2.6","matchCriteriaId":"E981DC2A-E9FB-4932-A793-314FCAD5CB2F"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/39f2032096715daae5f6fd0f587ca7a474b019df","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/fa0c45986fc60b3edfb35879f2fb0eacc0e49e98","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fea9c705bbc618ba6426424c9f8330555820c9ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-60096","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T15:17:54.497","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-60097","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T15:17:54.587","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-60098","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T15:17:54.657","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-60099","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T15:17:54.727","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-60100","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T15:17:54.783","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-60101","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T15:17:54.843","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-84862","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-25T15:17:56.110","lastModified":"2026-10-20T18:58:15.950","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Guardium Data Protection","cpes":["cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:guardium_data_protection:12.2.0:*:*:*:*:*:*:*"],"versions":[{"version":"12.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T03:55:50.546645Z","id":"CVE-2026-84862","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:guardium_data_protection:12.1:*:*:*:*:*:*:*","matchCriteriaId":"EADF2641-F8DF-4986-8106-287C615DE19D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*","matchCriteriaId":"CBA75153-5681-40C8-8EB4-236EF2EC8A4B"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288040","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-84882","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-25T15:17:56.273","lastModified":"2026-10-20T19:00:40.713","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker could exploit this vulnerability to write arbitrary files to the system."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Guardium Data Protection","cpes":["cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:guardium_data_protection:12.2.0:*:*:*:*:*:*:*"],"versions":[{"version":"12.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T00:00:00+00:00","id":"CVE-2026-84882","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:guardium_data_protection:12.1:*:*:*:*:*:*:*","matchCriteriaId":"EADF2641-F8DF-4986-8106-287C615DE19D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*","matchCriteriaId":"CBA75153-5681-40C8-8EB4-236EF2EC8A4B"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288035","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-88389","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T15:17:56.687","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain(). In RELEASE/NO_ASSERT builds, the missing assertion guard allows a write through the NULL pointer, resulting in memory corruption and application termination or denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:18:57.521290Z","id":"CVE-2026-88389","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/espruino/Espruino/commit/0db0663ac5201a6fea68094b45da673edec45187","source":"cve@mitre.org"},{"url":"https://github.com/espruino/Espruino/issues/2745","source":"cve@mitre.org"},{"url":"https://github.com/espruino/Espruino/issues/2745","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-93030","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-25T15:17:56.810","lastModified":"2026-09-25T16:17:29.980","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"IBM Financial Transaction Manager (FTM) for Redhat OpenShift","defaultStatus":"unaffected","versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.10.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:24:04.111638Z","id":"CVE-2026-93030","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-611"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com"}]}},{"cve":{"id":"CVE-2026-93306","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-25T15:17:56.943","lastModified":"2026-09-30T15:32:33.707","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a malformed HTTPS request to ASMI, causing the web server to crash with possible memory corruption and generate an error log. The ASMI web interface will restart automatically; however, repeated exploitation could result in a sustained loss of access to the ASMI management interface, resulting in an integrity and availability impact."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Server Firmware","cpes":["cpe:2.3:a:ibm:server_firmware:fw1120.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:server_firmware:fw1120.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:server_firmware:fw1120.01:*:*:*:*:*:*:*","cpe:2.3:a:ibm:server_firmware:fw1120.01.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:server_firmware:fw1110.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:server_firmware:fw1110.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:server_firmware:fw1110.31:*:*:*:*:*:*:*","cpe:2.3:a:ibm:server_firmware:fw1110.31.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:server_firmware:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:server_firmware:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:server_firmware:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:server_firmware:fw1060.81.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:server_firmware:fw950.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:server_firmware:fw950.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:server_firmware:fw950.h3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:server_firmware:fw950.h3.0:*:*:*:*:*:*:*"],"versions":[{"version":"FW1120.00","lessThanOrEqual":"FW1120.01","versionType":"custom","status":"affected"},{"version":"FW1110.00","lessThanOrEqual":"FW1110.31","versionType":"custom","status":"affected"},{"version":"FW1060.00","lessThanOrEqual":"FW1060.81","versionType":"custom","status":"affected"},{"version":"FW950.00","lessThanOrEqual":"FW950.H3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:11:12.282953Z","id":"CVE-2026-93306","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1080_\\(9080-hex\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1681A01A-7020-427B-848A-6E3CC0FE1E5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1080_\\(9080-hex\\):-:*:*:*:*:*:*:*","matchCriteriaId":"DF85251B-E02C-4293-98F0-D331BF51CAC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"6A492561-E2C8-4EAE-8D31-F20DA413BABC"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"90F8D763-A95F-4189-82DB-1DD6B134D244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1180_\\(9080-heu\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s922_\\(9009-22g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"A7A29250-6BFF-4BFD-8723-A584F5AFDD67"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s922_\\(9009-22g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"95E5E77F-A5BB-46E7-B6B6-B02F242DE829"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h922_\\(9223-22s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"852BF98B-82A6-4A6A-9541-BB65A2CDF650"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h922_\\(9223-22s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E7851003-8D6B-4FE8-87D7-BE968E85E448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s914_\\(9009-41g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D71B426C-DDDF-4341-9A2E-6A36569A1839"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s914_\\(9009-41g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"003F591A-ACCD-497E-BF8A-DE090321D778"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s924_\\(9009-42g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"E0EDDB11-824F-4E4E-838C-2A5AE1A79C0C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s924_\\(9009-42g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"4038C5DB-DF9C-4661-9590-F6A0CD4D15D5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h924_\\(9223-42s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"2A4BBB63-0102-44F0-AF76-4245872B2F89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h924_\\(9223-42s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"C2F0E93A-26F0-4914-8A31-3C86E64D5B8A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e950_\\(9040-mr9\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D4A756BD-C31D-4457-8B50-305B32E92785"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e950_\\(9040-mr9\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9FF58E5C-0A54-4F2F-A426-0BFD1EACE991"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e980_\\(9080-m9s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"52CB0665-0AE6-4A6E-A629-8AB47C7837C5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e980_\\(9080-m9s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9BE56BD8-DB0F-4151-9428-42F1B6452D99"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289331","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96812","sourceIdentifier":"cve-coordination@google.com","published":"2026-09-25T15:17:57.097","lastModified":"2026-09-25T17:17:20.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a /dev/cuse character device node in a container image, opening the device passes through to the host, allowing the sandboxed attacker to register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory."}],"affected":[{"source":"cve-coordination@google.com","affectedData":[{"vendor":"Google","product":"gVisor","defaultStatus":"unaffected","platforms":["Linux"],"repo":"https://github.com/google/gvisor","versions":[{"version":"0","lessThan":"573a9e73cf844f","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@google.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:07:43.360610Z","id":"CVE-2026-96812","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-668"}]}],"references":[{"url":"https://github.com/google/gvisor/commit/573a9e73cf844f","source":"cve-coordination@google.com"}]}},{"cve":{"id":"CVE-2026-97866","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T15:18:01.780","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in Zhonglun CloudPOS 3.0. Affected by this vulnerability is an unknown functionality of the file Program.cs of the component Automatic Update. Executing a manipulation of the argument version/url/packagekey/package name can lead to channel accessible by non-endpoint. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitation appears to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Zhonglun","product":"CloudPOS","cpes":["cpe:2.3:a:zhonglun:cloudpos:*:*:*:*:*:*:*:*"],"modules":["Automatic Update"],"versions":[{"version":"3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:P/A:P","baseScore":5.1,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":4.9,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:23:43.426944Z","id":"CVE-2026-97866","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-300"}]}],"references":[{"url":"https://github.com/user-attachments/files/30572292/CloudPos.docx","source":"cna@vuldb.com"},{"url":"https://github.com/xy-f0/CVE/issues/4","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97866","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/911606","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409883","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409883/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-100230","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T16:17:24.657","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \\ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"input-leap","product":"Input Leap","defaultStatus":"unknown","platforms":["Windows","MacOS"],"versions":[{"version":"0","lessThanOrEqual":"3.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:08:59.786693Z","id":"CVE-2026-100230","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-180"}]}],"references":[{"url":"https://github.com/deskflow/deskflow/security/advisories","source":"cve@mitre.org"},{"url":"https://github.com/input-leap/input-leap/blob/master/src/lib/inputleap/DropHelper.cpp","source":"cve@mitre.org"},{"url":"https://github.com/input-leap/input-leap/blob/v3.0.3/src/lib/inputleap/DragInformation.cpp","source":"cve@mitre.org"},{"url":"https://github.com/input-leap/input-leap/releases","source":"cve@mitre.org"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42072","source":"cve@mitre.org"},{"url":"https://raw.githubusercontent.com/debauchee/barrier/master/src/lib/barrier/DragInformation.cpp","source":"cve@mitre.org"},{"url":"https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/inputleap/ArgParser.cpp","source":"cve@mitre.org"},{"url":"https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/net/SecureSocket.cpp","source":"cve@mitre.org"},{"url":"https://raw.githubusercontent.com/input-leap/input-leap/v3.0.3/src/lib/server/Server.cpp","source":"cve@mitre.org"},{"url":"https://www.openwall.com/lists/oss-security/2026/09/25/4","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-33639","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:24.867","lastModified":"2026-09-29T20:17:19.983","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled tax_rate_decimal_places setting into an ALTER TABLE statement for ip_tax_rates in Settings::index() without strict integer validation. A crafted setting value can add clauses to the schema-changing statement and remove or alter required database columns. The resulting schema corruption can permanently modify financial data structures and make the application unavailable. This vulnerability is fixed in 1.7.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"InvoicePlane","product":"InvoicePlane","versions":[{"version":"< 1.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:17:48.570509Z","id":"CVE-2026-33639","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/8fe41750d7c6fd039ac7353e5311bf4c140c3436","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/efec2d28d574ca616f218d758bd5adaa9a60b3a0","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/fca7792a24de0a749d881cbbe4af6f58e9545d20","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/pull/1481","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/pull/1488","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-34g5-4hfc-g983","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-34g5-4hfc-g983","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-39353","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:25.053","lastModified":"2026-09-28T15:07:51.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as public_invoice_template. When a public invoice is rendered, the guest View controller includes the trusted file and executes it with web-server privileges. This issue is fixed in version 1.7.2-rc-1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"InvoicePlane","product":"InvoicePlane","versions":[{"version":"< 1.7.2-rc-1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:01:31.610429Z","id":"CVE-2026-39353","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-98"},{"lang":"en","value":"CWE-693"},{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/00e599db25804024eb323cfb751349bf3b1d8e8a","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/pull/1536","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2-rc-1","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-v735-2x3r-gwpp","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-v735-2x3r-gwpp","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-39372","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:25.243","lastModified":"2026-09-29T20:17:20.260","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata. When an administrator uploads an image through invoice attachments, quote attachments, or another attachment feature and shares it with another user, the recipient can retrieve embedded GPS coordinates, timestamps, and device information. The preserved metadata can disclose private location and device details across users. This vulnerability is fixed in 1.7.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"InvoicePlane","product":"InvoicePlane","versions":[{"version":"< 1.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:09:29.547751Z","id":"CVE-2026-39372","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-359"}]}],"references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/90381b49d9ff3a817cf25d12d7dc118eb070aa3a","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/pull/1507","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-7j67-2v6p-275v","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-7j67-2v6p-275v","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-42322","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:25.420","lastModified":"2026-09-28T15:17:17.113","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stored filename. An authenticated administrator can upload image content with a server-executable final extension, causing the file to be placed in the web-accessible logo directory and executed when requested if the web server handles that extension. This can permit arbitrary command execution, data disclosure, modification, persistence, and service disruption. This vulnerability is fixed in 16.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Piwigo","product":"Piwigo","versions":[{"version":"< 16.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:34:42.659667Z","id":"CVE-2026-42322","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/Piwigo/Piwigo/commit/1e7f7262cb30e6916779f93e66d5d6579ec75a11","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/commit/4a13ec9a8f4881ae1f23bdfd24d7b90cd0802cdc","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/releases/tag/16.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7w97-5g4p-xqvv","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7w97-5g4p-xqvv","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-42323","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:25.607","lastModified":"2026-09-28T15:17:17.250","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser stores those values in the bulk_manager_filter session state, and later query construction concatenates them into SQL predicates, unlike the validated POST filter path. An authenticated administrator can use crafted filter values to execute time-based or other SQL expressions and potentially disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Piwigo","product":"Piwigo","versions":[{"version":"< 16.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:29:23.227256Z","id":"CVE-2026-42323","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/Piwigo/Piwigo/commit/c7e30da5c1775b531ce9a30aac04134cd714b472","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/commit/e4f0989d350d66207066ea61f8ee8c137164fb2f","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/releases/tag/16.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7r67-9xhq-7p2c","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7r67-9xhq-7p2c","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-42324","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:25.793","lastModified":"2026-09-25T17:17:08.467","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/element_set_ranks.php stores administrator-controlled image_order[] values without enforcing the existing sort-field whitelist. The stored album image_order expression is later concatenated into ORDER BY clauses by admin/batch_manager_global.php, admin/batch_manager_unit.php, include/section_init.inc.php, and include/ws_functions/pwg.categories.php. When at least one album contains at least one photo, an authenticated administrator can store a crafted expression and trigger it in a later album or Batch Manager query to disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Piwigo","product":"Piwigo","versions":[{"version":"< 16.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:14:12.579220Z","id":"CVE-2026-42324","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/Piwigo/Piwigo/commit/ba1f803f8cefd3602ccb9c6f0155cd529510288a","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/commit/ef9e65386d76f9c85f1e23a45dd7af14a5b73a47","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/releases/tag/16.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-jhp4-7f82-8f6q","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-jhp4-7f82-8f6q","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-44642","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:25.970","lastModified":"2026-09-25T17:17:08.577","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists, so PHP 8 and later concatenate an unauthenticated username directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials. This can cause unauthorized database integrity changes and service disruption. This vulnerability is fixed in 16.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Piwigo","product":"Piwigo","versions":[{"version":"< 16.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:40:38.942377Z","id":"CVE-2026-44642","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/Piwigo/Piwigo/commit/1ff9d04534feb5f8f3cc2d3613c0fe8b51a1c0ba","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/commit/2cfa7a3d194c8b95edde43038d8f5be5a359e785","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/releases/tag/16.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-6wj3-7fhw-gfpm","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-6wj3-7fhw-gfpm","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-49850","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:26.140","lastModified":"2026-09-28T15:07:51.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete() and Invoices::delete_invoice_tax() as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator loads attacker-controlled content that requests an affected route, the application can delete an invoice or invoice tax record. The cross-origin action can remove financial data without the administrator's intent. This issue is fixed in version 1.7.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"InvoicePlane","product":"InvoicePlane","versions":[{"version":"< 1.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:17:48.994370Z","id":"CVE-2026-49850","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-98"}]}],"references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/2f426e39d3744f2d732dc48114f96eeac9cbbfc3","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-mhvh-4j3w-7pvj","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-50547","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:26.300","lastModified":"2026-09-28T15:07:51.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() method appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier. A low-privileged attacker who can influence the e-invoice configuration can use traversal sequences to include an existing PHP file. The standalone advisory establishes local file inclusion; code execution requires a separate file-upload or file-write primitive. This issue is fixed in version 1.7.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"InvoicePlane","product":"InvoicePlane","versions":[{"version":"< 1.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:05:00.670467Z","id":"CVE-2026-50547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-98"}]}],"references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/07ebd6b5922b47b941cc3c6922c39043ad558d8f","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/pull/1560","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-9248-qccw-7x7j","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-54790","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:26.600","lastModified":"2026-09-28T15:17:18.213","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled custom_field_table value without validating it against the allowed custom-field table names. Mdl_custom_fields::used() later concatenates that stored value into the FROM table and WHERE column identifier positions, so opening the custom-field edit form executes a second-order SQL injection. The injection can query arbitrary schema data and can cause application errors or denial of service. This issue is fixed in version 1.7.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"InvoicePlane","product":"InvoicePlane","versions":[{"version":"< 1.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:37:06.585358Z","id":"CVE-2026-54790","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/d3724169420758de7687c1a52c0003277aedfa95","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/pull/1573","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-vv4r-cgmw-w6x2","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-vv4r-cgmw-w6x2","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-62262","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:26.750","lastModified":"2026-09-29T20:17:21.483","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search URL. include/ws_functions/pwg.images.php stores the unvalidated value in the search rules, and include/functions_search.inc.php integer-casts only the lower rating bound while concatenating the raw value as the SQL upper bound. This allows error-based or blind extraction of database information and database-dependent time delays through the public search flow. No fixed version is available as of this review."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Piwigo","product":"Piwigo","versions":[{"version":"< 17.0.0beta1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:19:06.002386Z","id":"CVE-2026-62262","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/Piwigo/Piwigo/commit/9755d88edf38b94bafdedb0b3aba7304a94e2e5c","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/commit/aede490a0b3a6c246f1f4689ca86c8fee377a7ae","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hq29-8hhx-5jwc","source":"security-advisories@github.com"},{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hq29-8hhx-5jwc","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-67236","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:27.053","lastModified":"2026-10-15T20:24:24.710","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding rather than encryption, an attacker with same-origin cross-site scripting, an HTTP-readable network position, or local access to the browser cookie store could recover the actual login credentials; older browsers that treated an absent SameSite attribute as None also sent the cookie cross-site. This issue is fixed in versions 4.2.8 and 4.3.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.2.0, < 4.2.8","status":"affected"},{"version":">= 4.3.0, < 4.3.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T13:41:31.815135Z","id":"CVE-2026-67236","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-312"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.8","matchCriteriaId":"7D4107E2-55ED-4D10-B647-E89B9B572F08"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.2","matchCriteriaId":"E0BFA770-90AD-4D95-A0E1-A3D973C500D2"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/df9e7f4c0afd311a672705f020d301efad355745","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/edf1fbc7217aaf736955d2e13c9534901a2e0778","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-88vh-gx85-p36m","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-85274","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:28.010","lastModified":"2026-09-28T15:07:51.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Recurring::stop() as a state-changing GET route without CSRF token validation. When an authenticated administrator loads attacker-controlled content that requests /invoices/recurring/stop/{id}, the application stops the selected recurring invoice. An attacker can target multiple identifiers to interrupt recurring billing and cause financial loss. This issue is fixed in version 1.7.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"InvoicePlane","product":"InvoicePlane","versions":[{"version":"< 1.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:34:57.138398Z","id":"CVE-2026-85274","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/2c76ef5655c2c188110a9c1932338e6a3022ea20","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/pull/1636","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-qf9q-2hxm-4wh9","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-qf9q-2hxm-4wh9","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-85289","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:28.157","lastModified":"2026-09-28T15:07:51.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensure_valid_post_request() from delete methods including Payments::delete(), Recurring::delete(), and User_clients::delete(). Although the routes require POST, they do not validate the request's CSRF token. An attacker can submit a cross-origin form through an authenticated administrator's browser to delete financial records and other application data. This issue is fixed in version 1.7.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"InvoicePlane","product":"InvoicePlane","versions":[{"version":"< 1.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:55:58.195957Z","id":"CVE-2026-85289","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/215b8c1acca7560d00b7e463fb1c6fe98235ab95","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/pull/1637","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-9372-vj68-hmc3","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-9372-vj68-hmc3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-85290","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:28.310","lastModified":"2026-09-29T20:17:27.910","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur() method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can place forged log lines into the audit trail by supplying a crafted cron_key value. The injected entries can corrupt forensic records and interfere with log-based monitoring. This issue is fixed in version 1.7.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"InvoicePlane","product":"InvoicePlane","versions":[{"version":"< 1.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:14:22.266462Z","id":"CVE-2026-85290","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-117"}]}],"references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/97fd1b6a0426b132abea16ef767625fb357adb38","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/pull/1639","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-g53q-v2pv-xr83","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-g53q-v2pv-xr83","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-85291","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:28.457","lastModified":"2026-09-28T15:07:51.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Users::change_password() method accepts a user_id from the URL and updates that account's password without an object-level authorization check. An authenticated secondary administrator can target the primary administrator account and replace its password without knowing the current password. The attacker can then take over the primary account and access its data and privileges. This issue is fixed in version 1.7.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"InvoicePlane","product":"InvoicePlane","versions":[{"version":"< 1.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T13:49:37.962470Z","id":"CVE-2026-85291","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/7af2cdd1138ab5e9cd4d95333180e617aecc86cf","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-x38q-xhjj-jr8w","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-x38q-xhjj-jr8w","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-85292","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:28.600","lastModified":"2026-09-28T15:07:51.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's User_Controller compares the session user_type value with the required role by using PHP's loose inequality operator. Under a non-standard session backend that returns unexpected scalar types, type juggling can cause a value that is not strictly the required role to pass the authorization check. This can permit authentication or authorization bypass in affected session configurations. This issue is fixed in version 1.7.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"InvoicePlane","product":"InvoicePlane","versions":[{"version":"< 1.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:19:53.690399Z","id":"CVE-2026-85292","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-697"}]}],"references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/efa9f576faa93ba64bef52b09b119e81a5b22fcf","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/pull/1640","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-346c-gqqq-mrm2","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-85293","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:28.743","lastModified":"2026-09-28T15:07:51.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-beta-1, InvoicePlane stores client_email values without enforcing email syntax and renders them unescaped inside double-quoted value attributes in the invoice mailer form and quote mailer form. An administrator who can edit a client can store attribute-breaking input, and, when the mailer is configured, JavaScript executes when another authenticated administrator opens the related mailer page. The script runs in the InvoicePlane origin and can perform same-origin actions with the victim's session. This issue is fixed in version 1.7.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"InvoicePlane","product":"InvoicePlane","versions":[{"version":"< 1.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:58:37.209317Z","id":"CVE-2026-85293","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-87"}]}],"references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/1e74c032ff1c65e6a4f9d173505f415c3a539f57","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/pull/1635","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-477r-xmgc-vcvj","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-477r-xmgc-vcvj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-92161","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T16:17:29.387","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through provideTrustedEmail(). When Discord sign-in is enabled, an unauthenticated attacker who knows the email address of a Flarum user can configure a Discord account with that unverified address and a verified phone number, then sign in to cause Flarum to match the trusted address, link the attacker-controlled Discord identity to the existing user, and authenticate as the victim without a password or victim interaction. Exploitation requires that the victim's email address is not already associated with a Discord account, and it can compromise administrator accounts. Other bundled providers were not confirmed to be practically exploitable by this method because their relevant authentication flows return only verified or confirmed email addresses. This issue is fixed in versions 1.7.4 and 2.0.0-beta.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"FriendsOfFlarum","product":"oauth","versions":[{"version":"< 1.7.4","status":"affected"},{"version":">= 2.0.0-beta.1, < 2.0.0-beta.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:20:48.556795Z","id":"CVE-2026-92161","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]}],"references":[{"url":"https://github.com/FriendsOfFlarum/oauth/commit/baca3466b3b7be51c70a7e0ba966901aefeb344a","source":"security-advisories@github.com"},{"url":"https://github.com/FriendsOfFlarum/oauth/commit/bb4bf376832e6bb68c579715d2a4b5a92c4a2567","source":"security-advisories@github.com"},{"url":"https://github.com/FriendsOfFlarum/oauth/releases/tag/1.7.4","source":"security-advisories@github.com"},{"url":"https://github.com/FriendsOfFlarum/oauth/releases/tag/2.0.0-beta.4","source":"security-advisories@github.com"},{"url":"https://github.com/FriendsOfFlarum/oauth/security/advisories/GHSA-g7vj-c29h-3h5m","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-96874","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-25T16:17:30.407","lastModified":"2026-09-29T22:19:06.067","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS.\n\n\n\n\n\n\nThis issue affects Mediawiki - Cargo extension: through 3.9.4."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - Cargo extension","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.9.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:07:08.411563Z","id":"CVE-2026-96874","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328631","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T435207","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-97469","sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","published":"2026-09-25T16:17:30.713","lastModified":"2026-09-29T21:27:41.130","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed inside the sub-select. The problem is resolved in PostgreSQL Anonymizer 3.2.3 and later versions"}],"affected":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","affectedData":[{"vendor":"DALIBO","product":"PostgreSQL Anonymizer","defaultStatus":"unaffected","versions":[{"version":"1","lessThan":"3.2.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:06:34.584396Z","id":"CVE-2026-97469","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary","description":[{"lang":"en","value":"CWE-328"}]}],"references":[{"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/685","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}]}},{"cve":{"id":"CVE-2026-97868","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T16:17:31.537","lastModified":"2026-09-25T18:17:34.527","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEditor.jsx of the component Note Editor. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"sheshbabu","product":"zen","cpes":["cpe:2.3:a:sheshbabu:zen:*:*:*:*:*:*:*:*"],"modules":["Note Editor"],"versions":[{"version":"1.0","status":"affected"},{"version":"1.1","status":"affected"},{"version":"1.2","status":"affected"},{"version":"1.3","status":"affected"},{"version":"1.4","status":"affected"},{"version":"1.5.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:10:09.749958Z","id":"CVE-2026-97868","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://ctf-n0el4kls.notion.site/Store-XSS-in-sheshbabu-zen-3ae41990f44780dbadb6e6af57e6f833","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97868","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/911735","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409884","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409884/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97869","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T16:17:31.740","lastModified":"2026-09-28T15:14:01.513","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulation causes deserialization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been published and may be used. Upgrading to version 1.5.3-beta11, 1.11.10-beta19 and 1.18.1-beta28 is able to resolve this issue. Upgrading the affected component is advised. The project maintainer kindly explains: \"The issue was reported to us privately on 23 July 2026 and fixed in releases published on 29 July 2026. It is tracked as GHSA-gmwr-7wmf-mrjm. Exploitation requires an application to have enabled AgenticScope persistence, which is opt-in, and an attacker who can already write to that store. All maintained release lines have been patched.\""}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"langchain4j","cpes":["cpe:2.3:a:langchain4j:langchain4j:*:*:*:*:*:*:*:*"],"modules":["LangChain4j-agentic"],"versions":[{"version":"1.5.3-beta10","status":"affected"},{"version":"1.11.10-beta18","status":"affected"},{"version":"1.18.1-beta27","status":"affected"},{"version":"1.5.3-beta11","status":"unaffected"},{"version":"1.11.10-beta19","status":"unaffected"},{"version":"1.18.1-beta28","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":1.2,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":0.7,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:M/C:P/I:P/A:P","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":3.2,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:37:00.836381Z","id":"CVE-2026-97869","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/afish3201-debug/CVE/blob/main/Insecure%20Jackson%20Default%20Typing%20Leads%20to%20Arbitrary%20Class%20Instantiation%20in%20LangChain4j%20Agentic%20Module.md","source":"cna@vuldb.com"},{"url":"https://github.com/langchain4j/langchain4j/","source":"cna@vuldb.com"},{"url":"https://github.com/langchain4j/langchain4j/releases/tag/1.18.1","source":"cna@vuldb.com"},{"url":"https://github.com/langchain4j/langchain4j/security/advisories/GHSA-gmwr-7wmf-mrjm","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97869","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/911825","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409886","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409886/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-100237","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-25T17:17:07.127","lastModified":"2026-09-28T16:38:10.183","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS.\n\nThis issue affects Mediawiki - Thanks Extension: from * before 1.43.10/1.45.5/1.46.1."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - Thanks Extension","defaultStatus":"affected","versions":[{"version":"*","lessThan":"1.43.10/1.45.5/1.46.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:05:16.608362Z","id":"CVE-2026-100237","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/I6d563f9cdab25c07dcd0083f3af2126e0859d098","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T432424","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-100248","sourceIdentifier":"cve@mitre.org","published":"2026-09-25T17:17:07.243","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Rattadan","product":"Cosmowarp Contract","defaultStatus":"unaffected","modules":["Asset Registry"],"platforms":["CosmWasm"],"programFiles":["asset_registry/src/contract.rs"],"programRoutines":[{"name":"execute_update_config(deps: DepsMut, info: MessageInfo, admin: Option<String>)"}],"repo":"https://github.com/rattadan/Cosmowarp_Contract","versions":[{"version":"0","lessThan":"56c6147ee613a6aaa157ecefe2f7bf0ad9084fa8","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:X/RE:H/U:Red","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"IRRECOVERABLE","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"HIGH","providerUrgency":"RED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:51:33.690528Z","id":"CVE-2026-100248","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-1025"}]}],"references":[{"url":"https://github.com/rattadan/Cosmowarp_Contract/blob/cc75c6f105ddae7627d878365637ebc279f4821d","source":"cve@mitre.org"},{"url":"https://github.com/rattadan/Cosmowarp_Contract/blob/cc75c6f105ddae7627d878365637ebc279f4821d/asset_registry/src/contract.rs#L343","source":"cve@mitre.org"},{"url":"https://github.com/rattadan/Cosmowarp_Contract/commit/56c6147ee613a6aaa157ecefe2f7bf0ad9084fa8","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-18311","sourceIdentifier":"cret@cert.org","published":"2026-09-25T17:17:07.657","lastModified":"2026-09-28T16:31:16.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced devices when the malicious document is opened."}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"Readwise","product":"Reader","versions":[{"version":"8.7.2","lessThanOrEqual":"8.10.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:58:10.634438Z","id":"CVE-2026-18311","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://kb.cert.org/vuls/id/699627","source":"cret@cert.org"}]}},{"cve":{"id":"CVE-2026-18312","sourceIdentifier":"cret@cert.org","published":"2026-09-25T17:17:07.850","lastModified":"2026-09-28T16:31:16.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or JavaScript context encoding, a crafted metadata value can break out of the intended URL structure and inject script content. An attacker could supply a document containing malicious metadata that, once synchronized to an Android device and rendered in the Reader WebView, results in execution of injected script content, enabling stored cross-site scripting (XSS)"}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"Readwise","product":"Reader","versions":[{"version":"8.7.2","lessThanOrEqual":"8.10.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:56:09.413897Z","id":"CVE-2026-18312","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://kb.cert.org/vuls/id/699627","source":"cret@cert.org"}]}},{"cve":{"id":"CVE-2026-18320","sourceIdentifier":"cret@cert.org","published":"2026-09-25T17:17:08.013","lastModified":"2026-09-28T16:31:16.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS)."}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"Readwise","product":"Reader","versions":[{"version":"8.7.2","lessThan":"8.10.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:56:55.358504Z","id":"CVE-2026-18320","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://kb.cert.org/vuls/id/699627","source":"cret@cert.org"}]}},{"cve":{"id":"CVE-2026-56723","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:09.263","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging to an internal article via the attachment download endpoint, bypassing article-level authorization. This results in an inconsistency: The article listing hides internal articles from customers. The attachment download only checks the parent ticket, not the article, so the same customer can download the attachment directly. This issue is fixed in version 7.0.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:43:44.514504Z","id":"CVE-2026-56723","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/e661d00efb3d2c4ef4af3a36ce79d7c724323f97","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/releases/tag/7.0.2","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-374g-4f73-g7m7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-56724","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:09.420","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users with limited read permissions to interact with items outside their assigned access scope. Data access has been strengthened in the current version through additional validation routines. This issue is fixed in version 7.0.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:44:55.982397Z","id":"CVE-2026-56724","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/13ccc136e527adcab705ca8a3b2fb9ffc0cecddc","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/releases/tag/7.0.2","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-pv3q-74g5-w7fv","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-56729","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:09.557","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from categories they do not have editor access to , via the global quick search. Category names are not leaked, and opening the answer returns \"Page not found,\" but the title alone may disclose sensitive information. This vulnerability is fixed in 7.0.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:08:08.905916Z","id":"CVE-2026-56729","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-280"},{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/5076aa1e3081146f826ffaef686c89935fdb4393","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/commit/7b6c0adec006e036c9e605c4141a091a6e08aadf","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/commit/de5dc4195829e0e1a64307d60c9e06e0e781ab37","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-4m54-p3mr-22g2","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61837","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:09.810","lastModified":"2026-10-15T20:22:41.003","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks. the AMQP 1.0 HTTP-over-AMQP management endpoint GET /bindings (the rabbitamqpmanagement handler) enumerates bindings between an arbitrary source exchange and destination queue/exchange in the caller's virtual host without performing any resource-level permission check. Unlike every sibling operation in the same module (which call checkresourceaccess / bindingchecks), the GET handler ignores the authenticated User and returns the binding list unchanged. As a result, any authenticated AMQP 1.0 client that can open a management link pair , including users with no management/monitoring/policymaker/administrator tag , can enumerate the complete binding topology (source exchanges, destination queues/exchanges, routing keys, and binding arguments) of the virtual host they can access. The equivalent HTTP management API (GET /api/bindings) Confidentiality impact: a non-management AMQP 1.0 user can enumerate the complete routing topology of any virtual host it can connect to , every (source exchange, destination queue/exchange, routing key, binding arguments) This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, and 4.0.23."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.3.0, < 4.3.3","status":"affected"},{"version":">= 4.2.0, < 4.2.9","status":"affected"},{"version":">= 4.1.0, < 4.1.14","status":"affected"},{"version":">= 4.0.0, < 4.0.23","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:27:34.351868Z","id":"CVE-2026-61837","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.23","matchCriteriaId":"D5D13FFE-E0D9-4199-B413-C75E4A525550"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.14","matchCriteriaId":"D1298756-9945-4567-A288-410FAF5B54AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.9","matchCriteriaId":"D35C2182-6B6E-4E76-98E7-6C928D64CCA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.3","matchCriteriaId":"E6CDECF0-FDCF-4C38-AD9D-F7B1F1246AEB"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/341e3f2795ebd1f816e712530f651a3221d23ad9","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/b94004dea530f961b3dc649d94969b89f1a3183f","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w9hf-476r-443x","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w9hf-476r-443x","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-66071","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:09.987","lastModified":"2026-10-15T20:14:57.567","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extractscopes/1 parses scopes of the form .tag: and calls rabbitdatacoercion:toatom() to convert to a tag atom. The token signature is verified first, so the attacker cannot forge scopes , but in IdP configurations where scope content is user-influenced, each login with a novel tag value leaks one In deployments where users can influence the scopes included in their IdP-issued JWT rabbitmqauthbackendoauth2 enabled IdP permits attacker-influenced scope values in signed tokens. This issue is fixed in versions 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.22","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"},{"version":">= 4.3.0, < 4.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:53:05.694643Z","id":"CVE-2026-66071","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.22","matchCriteriaId":"F9CF5E9C-1315-47E2-B3FB-27A066E256F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.1","matchCriteriaId":"41410FDE-4B5E-4466-B7C4-A62FEBFA0C80"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/9a44124d9c932d6fc7d2a3b945e5a143e547bcb6","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/c5690583a53789a3bf00cca508b43e8246db0d11","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-89p2-f5cv-x5cg","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-66073","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:10.157","lastModified":"2026-10-08T15:29:11.363","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name (and the exchanges and bindings endpoints) accepts a node JSON field. The value goes through rabbitnodes:make → listtoatom with no cluster membership check first. Each unique value permanently leaks one atom. A March 2026 refactoring (ea61ce2563) introduced safe helpers in rabbitmgmtnodes.erl (parsenodename, safeatom, and requirenodename, using binarytoexistingatom) and fixed several callers (QQ replica ops, wmauthattempts, wmnodememoryets, getsortreverse, and rabbitfederationmgmt), but getnode/1 in rabbitmgmtutil.erl:880-885, the primary vector used by directrequest/6, was not Roughly 900K requests crash the VM via systemlimit, and all tenants lose Any user with the management tag and one vhost, the lowest privilege This issue is fixed in versions 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:43:02.733440Z","id":"CVE-2026-66073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/7f64311471840e68f8cae09e4d4fdc4c8aca9229","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6v53-r759-jrvx","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-66078","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:10.333","lastModified":"2026-10-15T20:07:28.857","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected (rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser). POST /api/users/bulk-delete iterates the supplied username list and calls rabbitauthbackendinternal:deleteuser/2 directly , that function has no protected-tag check , so the guard is silently An administrator can delete protected-tagged service accounts via the bulk endpoint, bypassing a safeguard the test suite confirms is rabbitmqmanagement enabled Attacker has the administrator tag A protected-tagged user. This issue is fixed in versions 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:23:41.607515Z","id":"CVE-2026-66078","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/e5b890a64b42ec1f79a8e9d735512150cf77479c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-j9m2-hw6x-rqr9","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-j9m2-hw6x-rqr9","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-67222","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:10.517","lastModified":"2026-10-15T20:01:46.570","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied list_to_atom/1 to every colon-delimited token in an attacker-controlled auth_mechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a large request. Exploitation requires the Shovel or Federation plugin to be in use, and setting auth_mechanism requires the policymaker tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T13:46:20.340797Z","id":"CVE-2026-67222","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-85jr-6rr2-j73r","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67223","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:10.670","lastModified":"2026-10-15T19:54:50.830","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes ${username} into user_dn_pattern without RFC 4514 DN escaping, allowing a crafted username to alter the LDAP bind DN and potentially select a different directory entry. Exploitation requires rabbitmq_auth_backend_ldap with a user_dn_pattern containing ${username}, a directory layout in which the injected suffix resolves usefully, and a password valid for the resulting DN. The advisory body identifies 3.13.15, 4.0.20, 4.1.11, 4.2.9, and 4.3.3 as fixed, while structured metadata identifies 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. No fixed-version assertion is certifiable until a curator resolves this conflict."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.18","status":"affected"},{"version":">= 4.0.0, < 4.0.23","status":"affected"},{"version":">= 4.1.0, < 4.1.14","status":"affected"},{"version":">= 4.2.0, < 4.2.9","status":"affected"},{"version":">= 4.3.0, < 4.3.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:50:52.557104Z","id":"CVE-2026-67223","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-90"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.18","matchCriteriaId":"2FF356DE-889B-4728-AD67-5FC1622C285E"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.23","matchCriteriaId":"D5D13FFE-E0D9-4199-B413-C75E4A525550"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.14","matchCriteriaId":"D1298756-9945-4567-A288-410FAF5B54AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.9","matchCriteriaId":"D35C2182-6B6E-4E76-98E7-6C928D64CCA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.3","matchCriteriaId":"E6CDECF0-FDCF-4C38-AD9D-F7B1F1246AEB"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/ad3ca47accd313a4a0dbcbbe17bf60fc8f4b2614","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/b54056e59b7fd3a2d7f07dfaba95f026e138eee8","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9x7r-g78c-5835","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67225","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:10.827","lastModified":"2026-10-20T13:37:31.533","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated during the Tune handshake but did not compare it with an inbound frame's declared length before buffering the frame. With the stream plugin enabled, a remote client could therefore cause excessive memory pressure and denial of service by declaring an oversized frame. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:42:24.094993Z","id":"CVE-2026-67225","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes","Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c8c4-gvv4-8j3q","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67226","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:11.000","lastModified":"2026-10-20T13:36:07.600","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits ~3-4M short tag strings. An administrator can crash the node in a single request by creating a user (or importing definitions) with ~1M unique tag administrator. This issue is fixed in versions 4.0.22 and 4.1.14 and 4.2.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.0.0, < 4.0.22","status":"affected"},{"version":">= 4.1.0, < 4.1.14","status":"affected"},{"version":">= 4.2.0, < 4.2.7","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:55:06.667719Z","id":"CVE-2026-67226","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.22","matchCriteriaId":"F9CF5E9C-1315-47E2-B3FB-27A066E256F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.14","matchCriteriaId":"D1298756-9945-4567-A288-410FAF5B54AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.7","matchCriteriaId":"B525D1C8-16A3-4188-AF51-9D5E9796CAED"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/86601c5a6d1c7e41060e3dbd165c88bdc91266ee","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7","source":"security-advisories@github.com","tags":["Release Notes","Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-34c7-r8w9-5wv8","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-34c7-r8w9-5wv8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67227","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:11.417","lastModified":"2026-10-20T13:35:01.383","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1, Atom exhaustion: toatom on global-parameter :name. resourceexists/2 (and the PUT/DELETE handlers) call rabbitdatacoercion:toatom/1 on the :name URL path segment. toatom/1 uses binarytoatom/2 (unsafe). The endpoint requires policymaker (not management, but below A user with the policymaker tag can crash the node by exhausting the atom table via repeated requests to /api/global-parameters/:name with unique :name Management plugin enabled policymaker tag ~1M HTTP. This issue is fixed in versions 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.0.0, < 4.0.22","status":"affected"},{"version":">= 4.1.0, < 4.1.14","status":"affected"},{"version":">= 4.2.0, < 4.2.7","status":"affected"},{"version":">= 4.3.0, < 4.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:47:50.875187Z","id":"CVE-2026-67227","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.22","matchCriteriaId":"F9CF5E9C-1315-47E2-B3FB-27A066E256F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.14","matchCriteriaId":"D1298756-9945-4567-A288-410FAF5B54AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.7","matchCriteriaId":"B525D1C8-16A3-4188-AF51-9D5E9796CAED"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.1","matchCriteriaId":"41410FDE-4B5E-4466-B7C4-A62FEBFA0C80"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/8fbe6d8112427e85fb9a9206b3eb6e9a3ddd3e39","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/fc591e7ee27a29657ca960930acefd3e4217e007","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7","source":"security-advisories@github.com","tags":["Release Notes","Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1","source":"security-advisories@github.com","tags":["Release Notes","Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-q7x8-97rh-cr24","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67230","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:11.600","lastModified":"2026-10-20T13:32:39.940","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max_frame_size nor login_timeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small frames and accumulate unbounded pre-authentication state. The rabbitmq_web_stomp plugin must be enabled, and no authentication is required to reach the vulnerable path. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.2.0, < 4.2.6","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 3.13.0, < 3.13.15","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:22:14.972578Z","id":"CVE-2026-67230","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/0b4080fa5d6f797b6331d0ce1db2b4bacd34560e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/8138edae6d2beaafe699a41a754d17420bdc2068","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/c1000ba89052608c01c052d98016403ba6e92222","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes","Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-7v63-j4gm-p4rh","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67234","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:11.743","lastModified":"2026-10-20T13:30:15.557","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_auth_mechanism or preferred_auth_mechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the browser from deleting the preference. The issue is not directly exploitable for code execution or data exfiltration; its security relevance is limited to stale authentication-mechanism preferences persisting across logout and login cycles. This issue is fixed in versions 4.2.8 and 4.3.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.2.0, < 4.2.8","status":"affected"},{"version":">= 4.3.0, < 4.3.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:53:50.305307Z","id":"CVE-2026-67234","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.8","matchCriteriaId":"7D4107E2-55ED-4D10-B647-E89B9B572F08"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.2","matchCriteriaId":"E0BFA770-90AD-4D95-A0E1-A3D973C500D2"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/149cb59d618cefa83c6deb02dbbb1e8a7a2bc968","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/baac0aaf170efeb4f124ee36b8417274fa8dcc1a","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8","source":"security-advisories@github.com","tags":["Release Notes","Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2","source":"security-advisories@github.com","tags":["Release Notes","Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-q286-p3m9-j69f","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67237","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:11.883","lastModified":"2026-10-20T12:56:42.837","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. The endpoint is exposed before authentication only when management.oauth_enabled is true, and exploitation through the cookie path additionally requires the attacker to plant an access_token cookie on the management host. This issue is fixed in versions 4.2.8 and 4.3.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.2.0, < 4.2.8","status":"affected"},{"version":">= 4.3.0, < 4.3.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:53:50.928309Z","id":"CVE-2026-67237","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.8","matchCriteriaId":"7D4107E2-55ED-4D10-B647-E89B9B572F08"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.2","matchCriteriaId":"E0BFA770-90AD-4D95-A0E1-A3D973C500D2"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/5cd6d841d84450324a4613501ed917d98828af23","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/a8041d528c1a71af4cb75ade247ed082fe6b83fb","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8","source":"security-advisories@github.com","tags":["Release Notes","Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2","source":"security-advisories@github.com","tags":["Release Notes","Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2rf7-f6r6-8rwh","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67239","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:12.030","lastModified":"2026-10-16T16:32:42.213","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI (sibling of V-11). lines 102/106/110 render peercertsubject / peercertissuer with raw <%= %> and no fmtstring(). RFC4514 backslash-escaping of </> is HTML-inert and bypassable (<img ... //>). Requires non-default config: a stream TLS listener with verifypeer and an attacker-obtainable trusted cert with a malicious Same as the connection.ejs finding, against operators viewing the stream-connection detail rabbitmqstream + rabbitmqstreammanagement enabled with a TLS listener using verifypeer Attacker can obtain a certificate signed by a CA the listener trusts, with attacker-chosen DN An operator views the. This issue is fixed in versions 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.18","status":"affected"},{"version":">= 4.0.0, < 4.0.23","status":"affected"},{"version":">= 4.1.0, < 4.1.14","status":"affected"},{"version":">= 4.2.0, < 4.2.9","status":"affected"},{"version":">= 4.3.0, < 4.3.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:44:00.484727Z","id":"CVE-2026-67239","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.18","matchCriteriaId":"2FF356DE-889B-4728-AD67-5FC1622C285E"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.23","matchCriteriaId":"D5D13FFE-E0D9-4199-B413-C75E4A525550"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.14","matchCriteriaId":"D1298756-9945-4567-A288-410FAF5B54AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.9","matchCriteriaId":"D35C2182-6B6E-4E76-98E7-6C928D64CCA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.3","matchCriteriaId":"E6CDECF0-FDCF-4C38-AD9D-F7B1F1246AEB"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-xm9p-57xv-vxwc","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67241","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:12.180","lastModified":"2026-10-16T16:31:17.443","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /exchanges/:name (lines 192-240) checks only configure on the declared exchange and passes XArgs straight to rabbitexchange:declare/7. It omits the checkreadpermitted(X) + checkwritepermitted(AE) that rabbitchannel.erl:2540-2548 enforces for the alternate-exchange argument on the AMQP 0-9-1 path. The same file already implements the analogous DLX check for queues (lines 708-719), confirming this is a missing-check bug rather than intentional A user with only configure on exchange X can route X's unroutable messages into an alternate exchange they have no write permission AMQP 1.0 enabled (default in RabbitMQ 4.x) Attacker has configure on at least one exchange but lacks write on the target. This issue is fixed in versions 4.2.9 and 4.3.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.2.0, < 4.2.9","status":"affected"},{"version":">= 4.3.0, < 4.3.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:25:44.226875Z","id":"CVE-2026-67241","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.9","matchCriteriaId":"D35C2182-6B6E-4E76-98E7-6C928D64CCA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.3","matchCriteriaId":"E6CDECF0-FDCF-4C38-AD9D-F7B1F1246AEB"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/18eac8d547b4382bf830c621b20a35932dd1cfa5","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/56005e7cebffc478ef397573de24aff1167e7cda","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rg2g-289m-xhhw","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rg2g-289m-xhhw","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67242","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:12.337","lastModified":"2026-10-16T16:22:54.410","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp. validatetokenexpiry/1 (lines 208-214) and expirytimestamp/1 (138-144) both guard with 'when isinteger(Exp)' and fall through to ok/never for float values. josejwt:verify validates only the signature, not exp. With float exp, no expiry validation occurs anywhere in the If the IdP emits exp as a JSON float (RFC 7519 permits fractional NumericDate), both the login-time expiry check and the mid-connection disconnect timer are silently skipped , an already-expired token is accepted, and connections never time OAuth2 backend enabled IdP emits float exp (uncommon; mainstream IdPs emit integers) Attacker possesses a previously-valid signed. This issue is fixed in versions 4.2.9 and 4.3.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.2.0, < 4.2.9","status":"affected"},{"version":">= 4.3.0, < 4.3.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T20:01:04.290645Z","id":"CVE-2026-67242","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.9","matchCriteriaId":"D35C2182-6B6E-4E76-98E7-6C928D64CCA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.3","matchCriteriaId":"E6CDECF0-FDCF-4C38-AD9D-F7B1F1246AEB"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/d10a369a96658d0fba1050bd43c732e58fcf28fd","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/f189a8824c9efbce46bd9438fcdbda4521cfc923","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rrj4-g94f-rqj9","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rrj4-g94f-rqj9","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67406","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:12.477","lastModified":"2026-10-16T16:16:49.703","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2 callback. When these processes crash (e.g., due to network partitions, connection failures), the OTP SASL error handler writes the full process state , including plaintext AMQP passwords and URIs , to the error log. This is particularly severe for the shovel worker, which stores deobfuscated plaintext URIs (including amqp://user:password@host format) in its genserver state for the entire process Automatic Credential Exposure: Shovel worker crashes (common during network partitions) automatically write plaintext upstream/downstream passwords to error logs No Special Configuration Needed: Unlike DEBUG logging, SASL error reports are always active Broad. This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, and 4.0.23."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.3.0, < 4.3.3","status":"affected"},{"version":">= 4.2.0, < 4.2.9","status":"affected"},{"version":">= 4.1.0, < 4.1.14","status":"affected"},{"version":">= 4.0.0, < 4.0.23","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:00:45.529742Z","id":"CVE-2026-67406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.23","matchCriteriaId":"D5D13FFE-E0D9-4199-B413-C75E4A525550"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.14","matchCriteriaId":"D1298756-9945-4567-A288-410FAF5B54AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.9","matchCriteriaId":"D35C2182-6B6E-4E76-98E7-6C928D64CCA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.3","matchCriteriaId":"E6CDECF0-FDCF-4C38-AD9D-F7B1F1246AEB"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-q44f-9vc5-grh7","source":"security-advisories@github.com","tags":["Vendor Advisory","Exploit"]}]}},{"cve":{"id":"CVE-2026-67407","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:12.620","lastModified":"2026-10-16T16:10:40.583","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex metacharacters in expanded topic-permission variables (escaperegex(V)), but escaperegexchar/1 escapes \\ ^ $ . | ? + ( ) [ ] { } and omits -. When a topic permission template places {clientid} inside a [...] character class A low-privileged authenticated MQTT user controlling its clientid can broaden topic authorization (read and write) when templates embed {clientid} in a [...] This issue is fixed in versions 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.3.2, < 4.3.3","status":"affected"},{"version":">= 4.2.0, < 4.2.9","status":"affected"},{"version":">= 4.1.0, < 4.1.14","status":"affected"},{"version":">= 4.0.0, < 4.0.23","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:20:18.793859Z","id":"CVE-2026-67407","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.23","matchCriteriaId":"D5D13FFE-E0D9-4199-B413-C75E4A525550"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.14","matchCriteriaId":"D1298756-9945-4567-A288-410FAF5B54AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.9","matchCriteriaId":"D35C2182-6B6E-4E76-98E7-6C928D64CCA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.3","matchCriteriaId":"E6CDECF0-FDCF-4C38-AD9D-F7B1F1246AEB"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-q46v-hrvq-hp24","source":"security-advisories@github.com","tags":["Vendor Advisory","Exploit","Mitigation"]}]}},{"cve":{"id":"CVE-2026-67408","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:12.767","lastModified":"2026-10-08T15:33:05.360","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.3.0, < 4.3.3","status":"affected"},{"version":">= 4.2.0, < 4.2.9","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:09:46.402384Z","id":"CVE-2026-67408","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.9","matchCriteriaId":"D35C2182-6B6E-4E76-98E7-6C928D64CCA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.3","matchCriteriaId":"E6CDECF0-FDCF-4C38-AD9D-F7B1F1246AEB"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/0f3defd176e027f54f447beee168d906d4f109b6","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/eb11bc44005fd6d327a78bf171bc598207778c9b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67409","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:12.943","lastModified":"2026-10-08T15:36:44.860","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252). the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response status code when downloading signing keys from the OAuth2 provider's JWKS endpoint. Non-200 responses (including 4xx and 5xx errors) are processed identically to successful responses. When the JWKS endpoint returns an error response with a valid-JSON body that lacks a keys field, all previously cached signing keys are destroyed, causing a persistent authentication denial of Files: deps/rabbitmqauthbackendoauth2/src/uaajwt.erl, lines 50-63 deps/rabbitmqauthbackendoauth2/src/uaajwks.erl, lines 5-7 deps/rabbitmqauthbackendoauth2/src/rabbitoauth2provider.erl, lines 98-107 Bug 1: HTTP status code ignored (uaajwt.erl:50-63): The Erlang httpc module returns {ok, {{HttpVersion, StatusCode, ReasonPhrase}, Headers, Body}}. The pattern {ok, {, , JwksBody}} matches ANY successful HTTP transaction Persistent authentication DoS: Once keys are destroyed, ALL OAuth2/JWT authentication fails for all users until a new successful JWKS refresh occurs Amplification: A single attacker can deny access to all legitimate OAuth2 users across the entire RabbitMQ. This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.3.0, < 4.3.3","status":"affected"},{"version":">= 4.2.0, < 4.2.9","status":"affected"},{"version":">= 4.1.0, < 4.1.14","status":"affected"},{"version":">= 4.0.0, < 4.0.23","status":"affected"},{"version":">= 3.13.0, < 3.13.18","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:49:17.770463Z","id":"CVE-2026-67409","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-252"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.18","matchCriteriaId":"2FF356DE-889B-4728-AD67-5FC1622C285E"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.23","matchCriteriaId":"D5D13FFE-E0D9-4199-B413-C75E4A525550"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.14","matchCriteriaId":"D1298756-9945-4567-A288-410FAF5B54AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.9","matchCriteriaId":"D35C2182-6B6E-4E76-98E7-6C928D64CCA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.3","matchCriteriaId":"E6CDECF0-FDCF-4C38-AD9D-F7B1F1246AEB"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-qw3h-qqm9-jrw8","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-qw3h-qqm9-jrw8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-67410","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:13.093","lastModified":"2026-10-08T15:43:35.610","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200). when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecret configuration value is included in the JavaScript served by the unauthenticated endpoint /js/oidc-oauth/bootstrap.js. Any user who can reach the management UI port can retrieve the OAuth2 client secret without Files: deps/rabbitmqmanagement/src/rabbitmgmtwmauth.erl, line 186 deps/rabbitmqmanagement/src/rabbitmgmtoauthbootstrap.erl, lines 35-50 deps/rabbitmqmanagement/src/rabbitmgmtdispatcher.erl, lines 45-49 (route registration) Code Path: 1. The route /js/oidc-oauth/bootstrap.js is registered as a plain Cowboy handler (rabbitmgmtdispatcher.erl:46): Credential exposure for the affected configuration: OAuth2 client secret is accessible without any authentication Token theft: Attacker can complete the authorization code flow using stolen authorization codes Client impersonation: Attacker can make requests. Any RabbitMQ deployment with: This issue is fixed in versions 4.3.3 and 4.2.9."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.3.0, < 4.3.3","status":"affected"},{"version":">= 4.2.0, < 4.2.9","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:45:46.514401Z","id":"CVE-2026-67410","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.9","matchCriteriaId":"D35C2182-6B6E-4E76-98E7-6C928D64CCA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.3","matchCriteriaId":"E6CDECF0-FDCF-4C38-AD9D-F7B1F1246AEB"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/60a85d3605ebf94fd234497242812547d441d457","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/869f800998334bb363f2ad046f58de9caedc409e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-f9f2-q3jf-wfj3","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67411","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:13.237","lastModified":"2026-10-08T16:46:06.173","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopback_users, causing the frontend-to-broker address to be treated as loopback. An attacker who can reach the trusted frontend and has valid credentials for a loopback-restricted account can therefore bypass the source-address restriction; the issue does not bypass password authentication. This issue is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.3.0, < 4.3.3","status":"affected"},{"version":">= 4.2.0, < 4.2.9","status":"affected"},{"version":">= 4.1.0, < 4.1.14","status":"affected"},{"version":">= 4.0.0, < 4.0.23","status":"affected"},{"version":">= 3.13.0, < 3.13.18","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:55:11.064286Z","id":"CVE-2026-67411","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.18","matchCriteriaId":"2FF356DE-889B-4728-AD67-5FC1622C285E"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.23","matchCriteriaId":"D5D13FFE-E0D9-4199-B413-C75E4A525550"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.14","matchCriteriaId":"D1298756-9945-4567-A288-410FAF5B54AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.9","matchCriteriaId":"D35C2182-6B6E-4E76-98E7-6C928D64CCA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.3","matchCriteriaId":"E6CDECF0-FDCF-4C38-AD9D-F7B1F1246AEB"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/a7528314840c4f8dc9904684f9f97ffa7aac6349","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/edbead0eabbd65925d0dc914a22d6a29e155e646","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-4r6f-9cpw-f6g6","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-4r6f-9cpw-f6g6","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67412","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:13.393","lastModified":"2026-10-08T16:44:57.637","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access. what the bug lets you do. A policymaker on one vhost reads and drains messages out of another vhost it has no permission on. With the default ack-mode the source messages are consumed (deleted), not copied. Why that should not 1. Federation validates the upstream URI without any vhost-access Cross-vhost message read/drain from a per-vhost policymaker, breaking vhost tenancy This issue is fixed in versions 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.3.0, < 4.3.3","status":"affected"},{"version":">= 4.2.0, < 4.2.9","status":"affected"},{"version":">= 4.1.0, < 4.1.14","status":"affected"},{"version":">= 4.0.0, < 4.0.24","status":"affected"},{"version":">= 3.13.0, < 3.13.18","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:44:37.491195Z","id":"CVE-2026-67412","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.18","matchCriteriaId":"2FF356DE-889B-4728-AD67-5FC1622C285E"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.24","matchCriteriaId":"C86C4B75-0764-4FF2-B6B9-BB2E9D073A06"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.14","matchCriteriaId":"D1298756-9945-4567-A288-410FAF5B54AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.9","matchCriteriaId":"D35C2182-6B6E-4E76-98E7-6C928D64CCA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.3","matchCriteriaId":"E6CDECF0-FDCF-4C38-AD9D-F7B1F1246AEB"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-42pc-678q-v8qj","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-42pc-678q-v8qj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67413","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:13.547","lastModified":"2026-10-16T16:02:56.927","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmq_jms_topic_exchange plugin's x-jms-topic exchange accepted a client-controlled rjms_erlang_selector binding expression whose LIKE evaluator expanded percent and underscore wildcards into overlapping PCRE fragments. It executed those fragments with raw re:run/3 without match or recursion limits, allowing an authenticated tenant that can bind and publish to consume broker scheduler CPU and deny service with pathological selectors. This issue is fixed in versions 4.0.23, 4.1.14, 4.2.9, and 4.3.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.2.0, < 4.2.9","status":"affected"},{"version":">= 4.1.0, < 4.1.14","status":"affected"},{"version":">= 4.3.0, < 4.3.3","status":"affected"},{"version":">= 4.0.0, < 4.0.23","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:29:50.102995Z","id":"CVE-2026-67413","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.23","matchCriteriaId":"D5D13FFE-E0D9-4199-B413-C75E4A525550"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.14","matchCriteriaId":"D1298756-9945-4567-A288-410FAF5B54AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.9","matchCriteriaId":"D35C2182-6B6E-4E76-98E7-6C928D64CCA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.3","matchCriteriaId":"E6CDECF0-FDCF-4C38-AD9D-F7B1F1246AEB"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/20203c50ea6ff459d462b2d4355326d3a870682c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/60de2fbbcd812ab294985cef260cc2f1b1a02a5b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/9e36b7f4c1e2eed77300288dca3e01bd9b23c432","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/f4d9da668b7304dfb9aeb2b4e9ff766a1275d021","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-chxf-3hfg-j8f7","source":"security-advisories@github.com","tags":["Vendor Advisory","Exploit"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-chxf-3hfg-j8f7","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory","Exploit"]}]}},{"cve":{"id":"CVE-2026-67415","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:13.690","lastModified":"2026-10-16T15:58:47.150","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter values into non-garbage-collected Erlang atoms before bounding them or checking a fixed allowlist. Exploitation requires network access to the Management HTTP API, valid credentials with both the management and policymaker tags, permission to set Shovel runtime parameters on a vhost, and the rabbitmq_shovel and rabbitmq_shovel_management plugins to be enabled. The attacker can exhaust the node-wide atom table and deny service, and malicious parameters are stored durably and reparsed when workers start, so atom pressure can recur after restart without a live attacker connection. This issue is fixed in versions 4.2.9 and 4.3.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.3.0, < 4.3.3","status":"affected"},{"version":">= 4.2.0, < 4.2.9","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:59:31.171216Z","id":"CVE-2026-67415","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.9","matchCriteriaId":"D35C2182-6B6E-4E76-98E7-6C928D64CCA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.3","matchCriteriaId":"E6CDECF0-FDCF-4C38-AD9D-F7B1F1246AEB"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-8mpg-qw9r-m5cr","source":"security-advisories@github.com","tags":["Vendor Advisory","Exploit","Mitigation"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-8mpg-qw9r-m5cr","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory","Exploit","Mitigation"]}]}},{"cve":{"id":"CVE-2026-67419","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:13.830","lastModified":"2026-10-16T15:46:33.137","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. The matcher materializes duplicate destinations before deduplication, causing combinatorial CPU work and memory pressure that can disrupt routing for all tenants. This vulnerability is fixed in 4.3.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":"< 4.3.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:01:28.563642Z","id":"CVE-2026-67419","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-407"},{"lang":"en","value":"CWE-1333"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.5","matchCriteriaId":"E6BFF644-8742-4806-9B49-2865A9C2B170"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/c5ed7c4e97e02be688730803604cc7a88dbe4864","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h964-v5mf-22cq","source":"security-advisories@github.com","tags":["Vendor Advisory","Exploit","Mitigation"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h964-v5mf-22cq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory","Exploit","Mitigation"]}]}},{"cve":{"id":"CVE-2026-67420","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:13.973","lastModified":"2026-10-16T15:38:45.787","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username token that no longer grants that tag, RabbitMQ updates the OAuth backend implementation (token/scopes/expiry) but leaves the connection's runtime #user.tags unchanged. rabbitaccesscontrol:checkuserid/2 then still honors the stale impersonator tag, so the connection (including newly opened channels) can continue publishing messages with a foreign AMQP userid after that privilege should have been revoked. A fresh connection using the downgraded token correctly refuses the same publish, proving the defect is stale session state rather than the token Limited to connections that once held impersonator and successfully refresh to a downgraded same-username rabbitauthbackendoauth2 (or an equivalent refresh-capable backend that returns tags) is enabled for This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.19","status":"affected"},{"version":">= 4.0.0, < 4.0.24","status":"affected"},{"version":">= 4.1.0, < 4.1.15","status":"affected"},{"version":">= 4.2.0, < 4.2.10","status":"affected"},{"version":">= 4.3.0, < 4.3.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:31:38.545817Z","id":"CVE-2026-67420","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.19","matchCriteriaId":"E1D2557E-EEF0-4FFA-853E-8A59AB960417"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.24","matchCriteriaId":"C86C4B75-0764-4FF2-B6B9-BB2E9D073A06"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.15","matchCriteriaId":"2420FA18-F4B8-48A5-8242-1EDDF12D0998"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.10","matchCriteriaId":"2193C32E-55EE-44AD-BE3D-8E260C8BD3BF"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.5","matchCriteriaId":"E6BFF644-8742-4806-9B49-2865A9C2B170"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/5de287d213765ca592ff5848ad2f6b9b98ee6772","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-86fm-44m9-rqjx","source":"security-advisories@github.com","tags":["Vendor Advisory","Mitigation","Exploit"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-86fm-44m9-rqjx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory","Mitigation","Exploit"]}]}},{"cve":{"id":"CVE-2026-67421","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T17:17:14.120","lastModified":"2026-10-06T19:53:05.337","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim's Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.19","status":"affected"},{"version":">= 4.0.0, < 4.0.24","status":"affected"},{"version":">= 4.1.0, < 4.1.15","status":"affected"},{"version":">= 4.2.0, < 4.2.10","status":"affected"},{"version":">= 4.3.0, < 4.3.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:57:04.069632Z","id":"CVE-2026-67421","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.9","matchCriteriaId":"BE94BFC0-4E01-408E-8620-2FEC79E94906"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.24","matchCriteriaId":"C86C4B75-0764-4FF2-B6B9-BB2E9D073A06"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.15","matchCriteriaId":"2420FA18-F4B8-48A5-8242-1EDDF12D0998"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.10","matchCriteriaId":"2193C32E-55EE-44AD-BE3D-8E260C8BD3BF"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.5","matchCriteriaId":"E6BFF644-8742-4806-9B49-2865A9C2B170"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/ff595eaaa6d4f580f72fa04801ffd35f48c46027","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6256-27fm-4rgr","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6256-27fm-4rgr","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-80432","sourceIdentifier":"4daa8cea-433a-44bd-9456-53b127fc289a","published":"2026-09-25T17:17:14.843","lastModified":"2026-09-29T21:32:59.833","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, because drop_enqueue_request() in kitty/dnd.c serves a drag data request without first checking the drop state of the window, so a client that issues the request while a drag is merely hovering receives the data offered for the drag. In the same file, drop_left_child(), which runs when the drag leaves the window without a drop having occurred, releases the offered MIME list but retains the pending request state, the open file descriptor and its main loop transfer timer, the directory handles, the URI list and the pending MIME name, so a client can continue to read through a retained directory handle, and an in-flight file transfer continues to stream, when no drag is in progress. The file contents are read from the filesystem by the kitty process itself using the paths the drag source offered. This results in disclosure of the contents of files the user moved over the window without ever releasing them into it."}],"affected":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","affectedData":[{"vendor":"Kovid Goyal","product":"kitty","defaultStatus":"unaffected","programFiles":["kitty/dnd.c"],"repo":"https://github.com/kovidgoyal/kitty","versions":[{"version":"0.47.0","lessThan":"0.49.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:54:28.515960Z","id":"CVE-2026-80432","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/kovidgoyal/kitty/commit/026d11f517da17bfd3c35ea502057babdfbe5828","source":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0","source":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://secur0.com/en/cna/cve-list/cve-2026-80432-kitty-dnd-data-before-drop","source":"4daa8cea-433a-44bd-9456-53b127fc289a"}]}},{"cve":{"id":"CVE-2026-89032","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T17:17:18.793","lastModified":"2026-10-01T04:18:21.403","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(). Attackers holding a valid virtual key can submit semantically similar prompts on affected routes such as /v1/responses and /bedrock/* to retrieve cached responses containing other tenants' personally identifiable information, financial data, or source code, and can cause agentic front-ends to auto-execute attacker-supplied tool calls under victim credentials by returning cached function_call or tool_calls payloads to a different principal."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"BerriAI","product":"litellm","defaultStatus":"unaffected","repo":"https://github.com/BerriAI/litellm","packageURL":"pkg:github/BerriAI/litellm","versions":[{"version":"0","lessThan":"1.101.0-rc.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-89032","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/BerriAI/litellm/commit/16db51e2cfc28e02bd460481e634a8403ea9265e","source":"disclosure@vulncheck.com"},{"url":"https://github.com/BerriAI/litellm/pull/39590","source":"disclosure@vulncheck.com"},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.101.0-rc.1","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/berriai-litellm-rc-1-tenant-isolation-bypass-via-semantic-cache-layer","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-91837","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-25T17:17:18.983","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters (special characters that can execute commands) in the 'nameserver' value, an attacker can inject and execute arbitrary commands. These commands run with root privileges before the application drops its elevated permissions, leading to local privilege escalation."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"vendor":"GNOME","product":"NetworkManager-iodine","defaultStatus":"unaffected","collectionURL":"https://gitlab.gnome.org/GNOME/network-manager-iodine","packageName":"network-manager-iodine","versions":[{"version":"0","lessThan":"*","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:39:28.774813Z","id":"CVE-2026-91837","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-91837","source":"patrick@puiterwijk.org"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533634","source":"patrick@puiterwijk.org"},{"url":"https://gitlab.gnome.org/GNOME/network-manager-iodine/-/work_items/4","source":"patrick@puiterwijk.org"}]}},{"cve":{"id":"CVE-2026-93363","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T17:17:19.157","lastModified":"2026-09-30T17:31:44.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint without possessing the required collection access permissions, circumventing the intended access control enforcement."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"payloadcms","product":"payload","defaultStatus":"unaffected","repo":"https://github.com/payloadcms/payload","packageURL":"pkg:github/payloadcms/payload","versions":[{"version":"3.25.0","lessThan":"3.90.0","versionType":"semver","status":"affected"},{"version":"4.0.0-canary.0","lessThan":"4.0.0-canary.34","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:06:56.287708Z","id":"CVE-2026-93363","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-mc8m-rr6c-r5qr","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/payload-cms-storage-vercel-blob-adapter-improper-access-control-on-upload-route","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-93364","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T17:17:19.307","lastModified":"2026-09-28T20:51:05.473","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and username through the Pages::edit() function in bl-kernel/pages.class.php, which iterates all fields declared in dbFields without per-field authorization, enabling an Author to convert pages to static site-wide navigation entries or transfer page ownership to arbitrary accounts."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Bludit","product":"Bludit CMS","defaultStatus":"unknown","repo":"https://github.com/bludit/bludit","packageURL":"pkg:github/bludit/bludit","versions":[{"version":"0","lessThanOrEqual":"3.22.0","versionType":"semver","status":"affected"},{"version":"0","lessThanOrEqual":"4.0.0-beta-1","versionType":"custom","status":"affected"},{"version":"0","lessThanOrEqual":"074773eff34b91c002ab9d99029a3edca4934bf1","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:42:49.466454Z","id":"CVE-2026-93364","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-915"}]}],"references":[{"url":"https://gist.github.com/akinerkisa/6a7532442795beefd29b9c55a100eb16","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/bludit-cms-mass-assignment-privilege-escalation-via-pages-edit","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-93365","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T17:17:19.487","lastModified":"2026-09-28T20:51:05.473","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX endpoint in bl-kernel/ajax/content-get-list.php. Attackers can send an authenticated GET request to the admin AJAX endpoint with the draft parameter set to true, triggering getList() without ownership constraints and returning serialized page objects site-wide, exposing pre-publication material and sensitive notes stored in administrator-owned drafts."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Bludit","product":"Bludit CMS","defaultStatus":"unknown","repo":"https://github.com/bludit/bludit","packageURL":"pkg:github/bludit/bludit","versions":[{"version":"0","lessThanOrEqual":"3.22.0","versionType":"semver","status":"affected"},{"version":"0","lessThanOrEqual":"4.0.0-beta-1","versionType":"custom","status":"affected"},{"version":"0","lessThanOrEqual":"074773eff34b91c002ab9d99029a3edca4934bf1","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:07:05.690103Z","id":"CVE-2026-93365","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://gist.github.com/akinerkisa/6a7532442795beefd29b9c55a100eb16","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/bludit-cms-missing-authorization-via-content-get-list-ajax-endpoint","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-94445","sourceIdentifier":"security@golang.org","published":"2026-09-25T17:17:19.963","lastModified":"2026-09-29T21:36:39.547","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem.\n\n\n\nDisjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host's $HOME.\n\n\n\nTogether, a well-crafted go env file and the go vet invocation could lead to remote code execution in the playground host itself.\n\n\n\n\nThis does not affect users of go.dev/play directly; however, it may affect independent deployments of golang.org/x/playground."}],"affected":[{"source":"security@golang.org","affectedData":[{"vendor":"golang.org/x/playground","product":"golang.org/x/playground","defaultStatus":"unaffected","collectionURL":"https://pkg.go.dev","packageName":"golang.org/x/playground","versions":[{"version":"0","lessThan":"0.0.0-20260924211604-6d73cff14c17","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:08:10.870774Z","id":"CVE-2026-94445","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@golang.org","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://go.dev/cl/838485","source":"security@golang.org"},{"url":"https://go.dev/issue/81737","source":"security@golang.org"}]}},{"cve":{"id":"CVE-2026-95834","sourceIdentifier":"4daa8cea-433a-44bd-9456-53b127fc289a","published":"2026-09-25T17:17:20.223","lastModified":"2026-09-29T21:32:59.833","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag_remote_file_data() in kitty/dnd.c holds a DragRemoteItem pointer into an array it does not own, calls toplevel_data_for_drag() or subdir_data_for_drag(), and then continues to use that pointer. Those helpers, and add_payload() and populate_dir_entries() which they call, report errors through the abrt() macro, which expands to cancel_drag() followed by a plain return, and cancel_drag() calls drag_free_offer(), which frees the array the pointer refers to. The helpers return void, so the caller receives no indication that the teardown happened, and proceeds to call all_children_complete() on the freed pointer, which dereferences it, and then to write through it. That dereference is guarded by a local flag that is set when the request carries no payload and announces no further data, which is the same condition that selects the finalisation block of add_payload(), so the error paths in that block reach it: a create that fails because an entry of the same name already exists, because the client may declare two entries with one name and the create operations use O_CREAT with O_EXCL and symlinkat(), a mkdirat() failure other than EEXIST, and the directory entry allocation paths. Both branches reach it. In the top level branch the caller's pointer is never cleared, so clearing the owning structure's own pointers during teardown does not help. In the sub directory branch subdir_data_for_drag() sets the caller's pointer to NULL on entry and assigns it only after its own last error path, so its own aborts leave the caller with NULL and are stopped by a null check, but it then calls add_payload() with that pointer set, and an abort there leaves the caller holding a freed child node inside the item tree, which drag_free_offer() frees by recursion. This results in undefined behaviour in the terminal process, reachable from the byte stream of any program running in the window."}],"affected":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","affectedData":[{"vendor":"Kovid Goyal","product":"kitty","defaultStatus":"unaffected","programFiles":["kitty/dnd.c"],"repo":"https://github.com/kovidgoyal/kitty","versions":[{"version":"0.47.0","lessThan":"0.49.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:59:17.317677Z","id":"CVE-2026-95834","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/kovidgoyal/kitty/commit/b54bfbb4f85f992edca9b04f5c0c2612454eec23","source":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0","source":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://secur0.com/en/cna/cve-list/cve-2026-95834-kitty-dnd-use-after-free","source":"4daa8cea-433a-44bd-9456-53b127fc289a"}]}},{"cve":{"id":"CVE-2026-95835","sourceIdentifier":"4daa8cea-433a-44bd-9456-53b127fc289a","published":"2026-09-25T17:17:20.403","lastModified":"2026-09-29T21:32:59.833","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handle_remote_askpass() in kitty/window.py opens the POSIX shared memory object named in the escape code, parses a prompt definition out of it, and writes the user's answer back into an object of that same name, without at any point checking that the object is owned by the user running kitty or that its permissions exclude other users. The equivalent consumer of the same SharedMemory class in the ssh kitten performs exactly that check; the askpass path did not. The handler is reached through a device control string processed from the byte stream of the window, so the attacker must also cause bytes of their choosing to be displayed by the victim's terminal. Where the POSIX shared memory namespace is shared between the two users, a second local user can create an object with permissions that allow the victim to read and write it, cause the victim's kitty to render a prompt of the attacker's choosing, including a masked password prompt, and read the typed secret back out of the object afterwards. The prompt text is additionally passed to the display without control character sanitisation, so it can overwrite the warning line kitty prints above it. The answer is written by reopening an object of that name when the user answers, rather than through the handle already held. This results in disclosure of a secret typed by the victim to a second local user, and does not require any privilege on the victim's account."}],"affected":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","affectedData":[{"vendor":"Kovid Goyal","product":"kitty","defaultStatus":"unaffected","programFiles":["kitty/window.py","kitty/shm.py"],"repo":"https://github.com/kovidgoyal/kitty","versions":[{"version":"0.25.0","lessThan":"0.49.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:59:53.708053Z","id":"CVE-2026-95835","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/kovidgoyal/kitty/commit/3281919056c442e4ba6f5abed7ee2c5130de31ff","source":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0","source":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://secur0.com/en/cna/cve-list/cve-2026-95835-kitty-askpass-shared-memory-ownership","source":"4daa8cea-433a-44bd-9456-53b127fc289a"}]}},{"cve":{"id":"CVE-2026-97871","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T17:17:21.443","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the component JSBridge. Such manipulation of the argument url leads to code injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Zhonglun","product":"CloudPos","cpes":["cpe:2.3:a:zhonglun:cloudpos:*:*:*:*:*:*:*:*"],"modules":["JSBridge"],"versions":[{"version":"3.0.1.0","status":"affected"},{"version":"3.0.1.1","status":"affected"},{"version":"3.0.1.2","status":"affected"},{"version":"3.0.1.3","status":"affected"},{"version":"3.0.1.4","status":"affected"},{"version":"3.0.1.5","status":"affected"},{"version":"3.0.1.6","status":"affected"},{"version":"3.0.1.7","status":"affected"},{"version":"3.0.1.8","status":"affected"},{"version":"3.0.1.9","status":"affected"},{"version":"3.0.1.10","status":"affected"},{"version":"3.0.1.11","status":"affected"},{"version":"3.0.1.12","status":"affected"},{"version":"3.0.1.13","status":"affected"},{"version":"3.0.1.14","status":"affected"},{"version":"3.0.1.15","status":"affected"},{"version":"3.0.1.16","status":"affected"},{"version":"3.0.1.17","status":"affected"},{"version":"3.0.1.18","status":"affected"},{"version":"3.0.1.19","status":"affected"},{"version":"3.0.1.20","status":"affected"},{"version":"3.0.1.21","status":"affected"},{"version":"3.0.1.22","status":"affected"},{"version":"3.0.1.23","status":"affected"},{"version":"3.0.1.24","status":"affected"},{"version":"3.0.1.25","status":"affected"},{"version":"3.0.1.26","status":"affected"},{"version":"3.0.1.27","status":"affected"},{"version":"3.0.1.28","status":"affected"},{"version":"3.0.1.29","status":"affected"},{"version":"3.0.1.30","status":"affected"},{"version":"3.0.1.31","status":"affected"},{"version":"3.0.1.32","status":"affected"},{"version":"3.0.1.33","status":"affected"},{"version":"3.0.1.34","status":"affected"},{"version":"3.0.1.35","status":"affected"},{"version":"3.0.1.36","status":"affected"},{"version":"3.0.1.37","status":"affected"},{"version":"3.0.1.38","status":"affected"},{"version":"3.0.1.39","status":"affected"},{"version":"3.0.1.40","status":"affected"},{"version":"3.0.1.41","status":"affected"},{"version":"3.0.1.42","status":"affected"},{"version":"3.0.1.43","status":"affected"},{"version":"3.0.1.44","status":"affected"},{"version":"3.0.1.45","status":"affected"},{"version":"3.0.1.46","status":"affected"},{"version":"3.0.1.47","status":"affected"},{"version":"3.0.1.48","status":"affected"},{"version":"3.0.1.49","status":"affected"},{"version":"3.0.1.50","status":"affected"},{"version":"3.0.1.51","status":"affected"},{"version":"3.0.1.52","status":"affected"},{"version":"3.0.1.53","status":"affected"},{"version":"3.0.1.54","status":"affected"},{"version":"3.0.1.55","status":"affected"},{"version":"3.0.1.56","status":"affected"},{"version":"3.0.1.57","status":"affected"},{"version":"3.0.1.58","status":"affected"},{"version":"3.0.1.59","status":"affected"},{"version":"3.0.1.60","status":"affected"},{"version":"3.0.1.61","status":"affected"},{"version":"3.0.1.62","status":"affected"},{"version":"3.0.1.63","status":"affected"},{"version":"3.0.1.64","status":"affected"},{"version":"3.0.1.65","status":"affected"},{"version":"3.0.1.66","status":"affected"},{"version":"3.0.1.67","status":"affected"},{"version":"3.0.1.68","status":"affected"},{"version":"3.0.1.69","status":"affected"},{"version":"3.0.1.70","status":"affected"},{"version":"3.0.1.71","status":"affected"},{"version":"3.0.1.72","status":"affected"},{"version":"3.0.1.73","status":"affected"},{"version":"3.0.1.74","status":"affected"},{"version":"3.0.1.75","status":"affected"},{"version":"3.0.1.76","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:41:33.306613Z","id":"CVE-2026-97871","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/user-attachments/files/30580490/CloudPos.CefSharp.RCE.docx","source":"cna@vuldb.com"},{"url":"https://github.com/xy-f0/CVE/issues/5","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97871","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/911849","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409887","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409887/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97877","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T17:17:21.763","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in zhistaredu StarTraining up to 3.8.1. This issue affects the function UserLoginService.createToken of the file application.yml of the component JWT Token Handler. This manipulation of the argument user_id/company_id causes use of hard-coded password. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"zhistaredu","product":"StarTraining","cpes":["cpe:2.3:a:zhistaredu:startraining:*:*:*:*:*:*:*:*"],"modules":["JWT Token Handler"],"versions":[{"version":"3.8.0","status":"affected"},{"version":"3.8.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:21:24.486127Z","id":"CVE-2026-97877","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-255"},{"lang":"en","value":"CWE-259"}]}],"references":[{"url":"https://github.com/ArrestX/startraining-advisories/blob/main/advisories/ST-VULN-001-jwt-hardcoded-secret-forge.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97877","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/913575","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409898","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409898/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97878","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T17:17:21.940","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Impacted is the function anonymous of the file /druid/index.html of the component Druid Console. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"zhistaredu","product":"StarTraining","cpes":["cpe:2.3:a:zhistaredu:startraining:*:*:*:*:*:*:*:*"],"modules":["Druid Console"],"versions":[{"version":"3.8.0","status":"affected"},{"version":"3.8.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:48:23.246522Z","id":"CVE-2026-97878","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/ArrestX/startraining-advisories/blob/main/advisories/ST-VULN-002-druid-console-unauth.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97878","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/913576","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409899","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409899/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97879","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T17:17:22.113","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"zhistaredu","product":"StarTraining","cpes":["cpe:2.3:a:zhistaredu:startraining:*:*:*:*:*:*:*:*"],"modules":["api-docs Endpoint"],"versions":[{"version":"3.8.0","status":"affected"},{"version":"3.8.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:02:11.698235Z","id":"CVE-2026-97879","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/ArrestX/startraining-advisories/blob/main/advisories/ST-VULN-003-swagger-api-docs-unauth.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97879","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/913577","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409900","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409900/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-56725","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T18:17:26.330","lastModified":"2026-09-29T20:17:20.750","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/import_check blocks a Zammad request worker for roughly two minutes. The import_check and import_status actions are missing the setup_done_response guard that other actions in the same controller carry, so they execute on fully set-up production instances. The action enters a retry loop against a blank OTRS endpoint, sleeping for 30 s + 45 s between attempts. Impact An unauthenticated remote attacker denies service to a production Zammad instance. Each request costs almost nothing and forces ~115 seconds of server-side blocking. A few requests per second saturate the Puma worker pool. The condition persists as long as the traffic continues. No account, valid import configuration, or target knowledge beyond the hostname is needed. CSRF token is trivially obtained from any prior GET response. This issue is fixed in version 7.0.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:37:05.600912Z","id":"CVE-2026-56725","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/a04a95b69496306af4c1fbd369a54981122e67c0","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/releases/tag/7.0.2","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-45cx-9mrq-mmcj","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-56726","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T18:17:26.480","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of GitHub/GitLab issues attached to any ticket in the system. This allows an internal user to systematically view GitHub/GitLab issue data linked by other agents or administrators across the organization by simply querying random or sequential ticket IDs. This vulnerability is fixed in 7.0.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:43:58.380438Z","id":"CVE-2026-56726","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/c767f32c006ff9842152f78e12f355f7f485304f","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/commit/e50ef69beab897317caa5e9490edba33aa1ac978","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/releases/tag/7.0.2","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-96hh-fmj3-h4hp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-56727","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T18:17:26.630","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler unconditionally wrote sign: { success: true, comment: \"Good signature\" } to the article's security preferences. Impact Any sender could tamper with the body of a multipart/signed PGP email, or craft a message with an entirely fabricated or mismatched signature, and Zammad would display it to the recipient as cryptographically verified with a \"Good signature\" label. Users and agents relying on Zammad's signature indicator to confirm message authenticity and integrity would be misled into trusting modified or forged content. The vulnerability affects all inbound PGP-signed emails processed while the PGP integration is enabled. This issue is fixed in version 7.0.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:41:56.938479Z","id":"CVE-2026-56727","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-347"},{"lang":"en","value":"CWE-391"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/4a9dd5f8a85948c5a2f96f6479d785153aac05d7","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/releases/tag/7.0.2","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-56jc-34c8-2xq4","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-56728","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T18:17:26.797","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with the target user's taskbar identifier. The taskbar feature stores transient state for active user sessions, including auto-saved ticket drafts. Under certain conditions, the authorization check for taskbar item access is not enforced, allowing a user to read another user's taskbar item data. This vulnerability is fixed in 7.0.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:38:13.258499Z","id":"CVE-2026-56728","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/4ccd5d573023b66b0d0184914c92417e1780793f","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/releases/tag/7.0.2","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-jvcg-5539-vvc3","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-56730","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T18:17:27.063","lastModified":"2026-09-29T20:17:20.890","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable GraphQL mutation is meant to transform a knowledge base answer suggestion so it can be inserted into the ticket editor, but it only checks if the user has the ticket.agent permission. Checking the authorization to the knowledge base answer itself is missing. This vulnerability is fixed in 7.0.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:35:45.655850Z","id":"CVE-2026-56730","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/b059bd1cac36b1eab04cfc0783799e38b8072da7","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/releases/tag/7.0.2","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-pf47-8964-pp23","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-56731","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T18:17:27.213","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization. This issue is fixed in version 7.0.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.0.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:42:46.394827Z","id":"CVE-2026-56731","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/16a4a2e1be6642ec0c3ba3a76e358ad065f48f78","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-p9xp-gx8r-4397","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-56732","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T18:17:27.370","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can trigger a logout request, terminating the viewer's session. This vulnerability is fixed in 7.0.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:40:25.769965Z","id":"CVE-2026-56732","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/3f6e8a5fa34eb0ce40f63292cf744f5f2992c9d0","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/releases/tag/7.0.2","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-6rmm-28j9-q99q","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-56733","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T18:17:27.533","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions during the initialization of new identity objects exhibits a discrepancy: Under specific conditions, the granular restrictions of the access key being used are overridden by the latent authorization authority of the parent account. Consequently, this means that the intended separation of functional areas is nullified, resulting in an uncontrolled expansion of administrative discretion. Due to this potential integrity breach of the entire trust environment, an immediate evaluation of the authorization hierarchies is imperative. Impact An attacker can create new administrator accounts despite token restrictions. This grants full access to all system data (tickets, customers, configuration) and allows the attacker to take complete control of the Zammad instance. Abuse Scenario The vulnerability stems from a lack of synergy between the token-based authorization logic and the target system's functional authorization hierarchy, which allows for iterative escalation of the privileged access context. This issue is fixed in versions 7.0.2 and 7.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:37:36.822447Z","id":"CVE-2026-56733","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/e50ef69beab897317caa5e9490edba33aa1ac978","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/commit/f059eb2d9835bdc2666750e805631f67ff485642","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/releases/tag/7.0.2","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/releases/tag/7.1.0","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-p3mg-2jxr-hww2","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-56734","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T18:17:27.700","lastModified":"2026-09-29T20:17:21.017","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication (OAuth/OIDC/SAML), a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider may cause the server to connect to internal network locations. Response timing and error patterns differ between reachable and unreachable targets, allowing internal service probing. Worker processes may be blocked for several seconds per request. Requires a configured external authentication provider where the actor can modify their profile image URL. This issue is fixed in version 7.0.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:34:45.868188Z","id":"CVE-2026-56734","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/1fae97d92496a643ea1490fb17070881e4e091d5","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/releases/tag/7.0.2","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-q3cr-3wq3-29hx","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-56735","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T18:17:28.880","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer (HtmlSanitizer::Strict) blocks external URLs in  to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight allows an attacker to embed arbitrary external URLs in the srcset attribute just by sending an e-mail, effectively bypassing the external content protection. When an agent views the ticket containing the malicious srcset, the browser will silently load the attacker-controlled URL, resulting in the leakage of the agent's IP address, User-Agent, Referer, and the exact time the ticket was viewed. HtmlSanitizer::Strict got extended to block external URLs in the srcset attribute of  tags. This was done to prevent tracking pixels and external content loading, which could compromise user privacy. This issue is fixed in versions 7.0.2 and 7.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:06:28.516570Z","id":"CVE-2026-56735","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-82"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/02c1ff8dc65961352dc047013bece9dff1f2ffb7","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/releases/tag/7.0.2","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/releases/tag/7.1.0","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-7fwx-3xr4-qm6w","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61525","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T18:17:29.030","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficiently validated before being used to construct internal file paths. When the file-based session store is active (the default configuration), an authenticated attacker can manipulate the session identifier to reference locations outside the intended storage directory, leading to the deletion of arbitrary files and directories on the server. Exploitation requires only a low-privilege authenticated session and a single crafted request. Instances configured to use the Redis-based session store are not affected. This issue is fixed in versions 7.0.3 and 7.1.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"= 7.0.2","status":"affected"},{"version":"= 7.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:30:33.479185Z","id":"CVE-2026-61525","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/cf3425712e8fae1bd40fa5814a49dc318dc84006","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/commit/f78ef2434fd8aad6c2fb8a702788f6e3f33565f6","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-xp9w-hhf3-vfxx","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-65828","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T18:17:29.193","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroy_form action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied form_id without verifying that the requesting user owns those records. An authenticated attacker who learns another user's pending-upload UUID can silently remove temporary file uploads before the victim submits their ticket or article. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:38:49.403514Z","id":"CVE-2026-65828","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/3b755736fdbee8ff6ddf53661d6912d3d3028325","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-x4f3-367g-m93g","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-84462","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T18:17:30.797","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypassed by entering specially crafted text into one of an AI Agent's fields. An administrator with permission to create or edit AI Agents could exploit this to run arbitrary commands on the server that hosts Zammad, potentially reading, modifying, or destroying all data stored on that server. No interaction from other users is needed; the malicious code runs automatically the next time the affected AI Agent processes a ticket. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:11:23.119845Z","id":"CVE-2026-84462","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-1336"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/e3b0c8df91ad2108c8305be23e8fe6f73fb9718d","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-gp3x-9xm8-rcj6","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91838","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-25T18:17:32.530","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped characters are then processed by the `pppd` daemon, which runs with root privileges, allowing the attacker to execute arbitrary commands with elevated permissions when a malicious VPN connection is activated."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"vendor":"GNOME","product":"NetworkManager-sstp","defaultStatus":"unaffected","collectionURL":"https://gitlab.gnome.org/GNOME/network-manager-sstp","packageName":"network-manager-sstp","versions":[{"version":"0","lessThan":"*","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:16:05.405073Z","id":"CVE-2026-91838","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-91838","source":"patrick@puiterwijk.org"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533637","source":"patrick@puiterwijk.org"},{"url":"https://gitlab.gnome.org/GNOME/network-manager-sstp/-/work_items/67","source":"patrick@puiterwijk.org"},{"url":"https://gitlab.gnome.org/GNOME/network-manager-sstp/-/work_items/67","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-91839","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-25T18:17:32.660","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF) characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile to inject additional configuration directives. This can lead to arbitrary code execution with root privileges when the crafted VPN connection is activated."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"vendor":"GNOME","product":"NetworkManager-fortisslvpn","defaultStatus":"unaffected","collectionURL":"https://gitlab.gnome.org/GNOME/NetworkManager-fortisslvpn","packageName":"network-manager-fortisslvpn","versions":[{"version":"0","lessThan":"*","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T03:55:54.065989Z","id":"CVE-2026-91839","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-93"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-91839","source":"patrick@puiterwijk.org"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533640","source":"patrick@puiterwijk.org"},{"url":"https://gitlab.gnome.org/Archive/NetworkManager-fortisslvpn/-/work_items/80","source":"patrick@puiterwijk.org"}]}},{"cve":{"id":"CVE-2026-91840","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-25T18:17:32.793","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when the malicious VPN connection is activated."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"vendor":"GNOME","product":"NetworkManager-vpnc","defaultStatus":"unaffected","collectionURL":"https://gitlab.gnome.org/GNOME/NetworkManager-vpnc","packageName":"network-manager-vpnc","versions":[{"version":"0","lessThan":"*","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T03:55:53.355838Z","id":"CVE-2026-91840","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-93"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-91840","source":"patrick@puiterwijk.org"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533642","source":"patrick@puiterwijk.org"},{"url":"https://gitlab.gnome.org/Archive/NetworkManager-vpnc/-/work_items/19","source":"patrick@puiterwijk.org"}]}},{"cve":{"id":"CVE-2026-91841","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-25T18:17:32.923","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege escalation."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"vendor":"GNOME","product":"NetworkManager-vpnc","defaultStatus":"unaffected","collectionURL":"https://gitlab.gnome.org/GNOME/NetworkManager-vpnc","packageName":"network-manager-vpnc","versions":[{"version":"0","lessThan":"*","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T03:55:52.659097Z","id":"CVE-2026-91841","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-93"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-91841","source":"patrick@puiterwijk.org"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533651","source":"patrick@puiterwijk.org"},{"url":"https://gitlab.gnome.org/Archive/NetworkManager-vpnc/-/work_items/20","source":"patrick@puiterwijk.org"},{"url":"https://gitlab.gnome.org/Archive/NetworkManager-vpnc/-/work_items/20","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-93366","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T18:17:33.583","lastModified":"2026-09-30T18:18:42.810","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid parameters to unprotected AJAX endpoints. Attackers can retrieve page UUIDs for all users via the content-get-list endpoint and then submit crafted POST requests to the list-images and delete-image endpoints in bl-kernel/ajax/ to access and destroy media files outside their own pages, bypassing the IMAGE_RESTRICT isolation control."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Bludit","product":"Bludit CMS","defaultStatus":"unknown","repo":"https://github.com/bludit/bludit","packageURL":"pkg:github/bludit/bludit","versions":[{"version":"0","lessThanOrEqual":"3.22.0","versionType":"semver","status":"affected"},{"version":"0","lessThanOrEqual":"4.0.0-beta-1","versionType":"custom","status":"affected"},{"version":"0","lessThanOrEqual":"074773eff34b91c002ab9d99029a3edca4934bf1","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:48:29.839760Z","id":"CVE-2026-93366","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://gist.github.com/akinerkisa/6a7532442795beefd29b9c55a100eb16","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/bludit-cms-authorization-bypass-via-list-images-delete-image-ajax-endpoints","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-97882","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T18:17:35.063","lastModified":"2026-09-29T20:17:32.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file loginlinkfaculty.php of the component Faculty Authentication. Executing a manipulation of the argument fid/pass can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"modules":["Faculty Authentication"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:32:53.845407Z","id":"CVE-2026-97882","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/smithbraz/PoC-CloudClassroom-AuthBypass","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97882","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/914555","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409901","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409901/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97883","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T18:17:35.247","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. The manipulation of the argument gid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:27:03.504968Z","id":"CVE-2026-97883","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/vinniboy021-blip/Advisory/blob/main/updatequery-sqli.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97883","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/914562","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409902","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409902/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97884","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T18:17:35.433","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatestudent.php of the component Student Update Functionality. The manipulation of the argument eno results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"modules":["Student Update Functionality"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:39:21.618643Z","id":"CVE-2026-97884","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/hofuman/CVE/blob/main/README.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97884","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/914563","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409903","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409903/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97885","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T18:17:35.613","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updatefaculty.php. This manipulation of the argument fid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:10:23.266487Z","id":"CVE-2026-97885","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/luan-oliveira01/Advisory-CloudClassroom-PHP-Project-1.0/blob/main/SQLi/ADVISORY.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97885","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/914564","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409904","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409904/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97886","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T18:17:35.810","lastModified":"2026-09-29T19:17:39.257","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file managevideos2.php. Such manipulation of the argument editassid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T18:10:27.346400Z","id":"CVE-2026-97886","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/Rita-Cerejo/CVE/blob/main/README.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97886","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/914571","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409905","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409905/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-100192","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T19:16:49.230","lastModified":"2026-09-29T20:17:09.160","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"yzcheng90","product":"X-SpringBoot","defaultStatus":"unaffected","repo":"https://github.com/yzcheng90/X-SpringBoot","packageURL":"pkg:github/yzcheng90/X-SpringBoot","versions":[{"version":"0","lessThanOrEqual":"6.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:38:37.267264Z","id":"CVE-2026-100192","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/01_app-credential-sms-abuse.py","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yzcheng90/X-SpringBoot","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/application/controller/XApplicationController.java#L59-L64","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/x-springboot-through-6.0-credential-exposure-via-unauthenticated-endpoint","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100303","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T19:16:50.423","lastModified":"2026-09-30T01:16:31.370","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories. Authenticated non-admin users can add, modify, or delete themes and theme categories affecting forms owned by other users."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"TDuckCloud","product":"tduck-survey-form","defaultStatus":"unaffected","collectionURL":"https://github.com/TDuckCloud/tduck-survey-form","repo":"https://github.com/TDuckCloud/tduck-survey-form","versions":[{"version":"0","lessThanOrEqual":"6.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:05:01.244891Z","id":"CVE-2026-100303","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_theme_write.py","source":"disclosure@vulncheck.com"},{"url":"https://github.com/TDuckCloud/tduck-survey-form","source":"disclosure@vulncheck.com"},{"url":"https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/FormThemeController.java#L61-L120","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-missing-authorization-in-form-theme-management-endpoints","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100304","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T19:16:50.797","lastModified":"2026-09-29T18:17:03.733","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providing a known dataId to the GET /user/form/data/details endpoint after the form has been permanently deleted."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"TDuckCloud","product":"tduck-survey-form","defaultStatus":"unaffected","collectionURL":"https://github.com/TDuckCloud/tduck-survey-form","repo":"https://github.com/TDuckCloud/tduck-survey-form","versions":[{"version":"6.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:49:17.063623Z","id":"CVE-2026-100304","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-636"}]}],"references":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_data_details_orphan.py","source":"disclosure@vulncheck.com"},{"url":"https://github.com/TDuckCloud/tduck-survey-form","source":"disclosure@vulncheck.com"},{"url":"https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java#L451-L459","source":"disclosure@vulncheck.com"},{"url":"https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-form/src/main/java/com/tduck/cloud/form/service/impl/UserFormDataServiceImpl.java#L169-L187","source":"disclosure@vulncheck.com"},{"url":"https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-form/src/main/java/com/tduck/cloud/form/util/FormAuthUtils.java#L25-L39","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/tduck-survey-form-6.0-information-disclosure-via-fail-open-form-ownership-check","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100305","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T19:16:50.973","lastModified":"2026-09-28T20:51:05.473","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/form/data/create. Authenticated attackers who know a form's key can submit unlimited entries to any form, bypassing publish status, time window, quota, and per-IP restrictions to falsify collected results."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"TDuckCloud","product":"tduck-survey-form","defaultStatus":"unaffected","collectionURL":"https://github.com/TDuckCloud/tduck-survey-form","repo":"https://github.com/TDuckCloud/tduck-survey-form","versions":[{"version":"0","lessThanOrEqual":"6.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:06:44.808090Z","id":"CVE-2026-100305","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_data_create_bypass.py","source":"disclosure@vulncheck.com"},{"url":"https://github.com/TDuckCloud/tduck-survey-form","source":"disclosure@vulncheck.com"},{"url":"https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java#L135-L172","source":"disclosure@vulncheck.com"},{"url":"https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-form/src/main/java/com/tduck/cloud/form/service/impl/UserFormSettingServiceImpl.java#L77-L135","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-fill-in-restriction-bypass-via-authenticated-submission-endpoint","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100306","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T19:16:51.167","lastModified":"2026-09-30T18:17:58.810","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"TDuckCloud","product":"tduck-survey-form","defaultStatus":"unaffected","collectionURL":"https://github.com/TDuckCloud/tduck-survey-form","repo":"https://github.com/TDuckCloud/tduck-survey-form","versions":[{"version":"0","lessThanOrEqual":"6.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:49:37.610416Z","id":"CVE-2026-100306","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-602"}]}],"references":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_data_create_bypass.py","source":"disclosure@vulncheck.com"},{"url":"https://github.com/TDuckCloud/tduck-survey-form","source":"disclosure@vulncheck.com"},{"url":"https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java#L152-L172","source":"disclosure@vulncheck.com"},{"url":"https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java#L154-L162","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-write-password-bypass-via-client-side-enforcement","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-45801","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:16:53.747","lastModified":"2026-09-25T20:17:06.733","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue is fixed in versions 11.0.8 and 10.0.26."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"glpi-project","product":"glpi","versions":[{"version":">= 0.72, < 10.0.26","status":"affected"},{"version":">= 11.0.0, < 11.0.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:41:33.012417Z","id":"CVE-2026-45801","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/glpi-project/glpi/commit/e9d8765122aafda5c61eba33bcbd8323569c8a53","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/commit/fb72d60cfc0e155f8f7707f0a2398bd5f17d7071","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/10.0.26","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-3vhr-7p54-cqhw","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-47679","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:16:54.967","lastModified":"2026-09-25T19:16:55.123","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions 11.0.8 and 10.0.26."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"glpi-project","product":"glpi","versions":[{"version":">= 10.0.0, < 10.0.26","status":"affected"},{"version":">= 11.0.0, < 11.0.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:05:42.536995Z","id":"CVE-2026-47679","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/glpi-project/glpi/commit/54306faf6a724321ba82c53c7c07ff6612a0d832","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/commit/78ec583051bac3c1b3f9d21729c55cac62afa2f3","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/10.0.26","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-x5r8-r6vj-79cw","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-48482","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:16:55.180","lastModified":"2026-09-30T01:16:37.383","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location, allowing a malicious script to be invoked remotely. This issue is fixed in version 11.0.8."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"glpi-project","product":"glpi","versions":[{"version":">= 11.0.0, < 11.0.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:02:48.285906Z","id":"CVE-2026-48482","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/glpi-project/glpi/commit/d817cb5c17e3368c89d4a561a43a777662b9da19","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-6whc-g4h2-98rm","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-49469","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:16:58.033","lastModified":"2026-09-29T18:17:15.577","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"glpi-project","product":"glpi","versions":[{"version":">= 0.70, < 10.0.26","status":"affected"},{"version":">= 11.0.0, < 11.0.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T18:00:05.834498Z","id":"CVE-2026-49469","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-90"}]}],"references":[{"url":"https://github.com/glpi-project/glpi/commit/4fb3056bcd292b515acce96887f1376ce6d5aba8","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/commit/d413b48ea97b2f73ba30c90ae0d029aac860f71a","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/10.0.26","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-3cgm-rj32-hfwf","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-49470","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:16:58.220","lastModified":"2026-09-28T14:17:15.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. This issue is fixed in version 11.0.8."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"glpi-project","product":"glpi","versions":[{"version":">= 11.0.0, < 11.0.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T13:40:06.632907Z","id":"CVE-2026-49470","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-307"}]}],"references":[{"url":"https://github.com/glpi-project/glpi/commit/19a0e81a2b09fee43b3e2a603639fc9b61360c73","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-mcv8-4hfg-5x2x","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-53610","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:27.123","lastModified":"2026-09-29T18:17:15.713","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. This issue is fixed in version 11.0.8."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"glpi-project","product":"glpi","versions":[{"version":">= 11.0.0, < 11.0.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:55:15.182109Z","id":"CVE-2026-53610","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/glpi-project/glpi/commit/9b17a3b2b91070cf197dedae3286322a41c4bc92","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-76v9-ch69-g67r","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-53625","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:27.477","lastModified":"2026-09-25T19:17:27.617","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a super-administrator's authentication method and enable account takeover. This issue is fixed in versions 11.0.8 and 10.0.26."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"glpi-project","product":"glpi","versions":[{"version":">= 0.70, < 10.0.26","status":"affected"},{"version":">= 11.0.0, < 11.0.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:06:15.761418Z","id":"CVE-2026-53625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/glpi-project/glpi/commit/9329f1ecac8099b54c2ca4dd770d78f82e1e6db8","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/commit/eb1b4299e81abeac764902b422cf7fcd59ac85d0","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/10.0.26","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-94rp-v9f2-5rj7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-53626","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:27.670","lastModified":"2026-09-30T01:16:37.700","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to read a document linked to an inaccessible item. This issue is fixed in version 11.0.8."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"glpi-project","product":"glpi","versions":[{"version":">= 11.0.5, < 11.0.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:03:56.216181Z","id":"CVE-2026-53626","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/glpi-project/glpi/commit/e984bf1ba435cee7319679df842c61b756baf191","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-q9rc-v6vm-q5mm","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-53627","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:27.870","lastModified":"2026-09-25T19:17:28.007","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable authorization checks. This issue is fixed in version 11.0.8."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"glpi-project","product":"glpi","versions":[{"version":">= 11.0.0, < 11.0.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:03:25.690853Z","id":"CVE-2026-53627","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/glpi-project/glpi/commit/0fdd973c4bb3f203c6905a62a93512e5ca8604c0","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-p68f-rv24-mc54","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-53628","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:28.067","lastModified":"2026-09-30T01:16:37.830","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The affected user-account administration flow did not consistently enforce the target user's entity-scoped update permission. This issue is fixed in versions 11.0.8 and 10.0.26."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"glpi-project","product":"glpi","versions":[{"version":">= 0.84, < 10.0.26","status":"affected"},{"version":">= 11.0.0, < 11.0.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:31.822673Z","id":"CVE-2026-53628","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/glpi-project/glpi/commit/27cc088f2b134fdcca0643b2485c9bfcc779bc4f","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/commit/f06a790d64ea18f8ad4ba5cf8236115dd882c364","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/10.0.26","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-2hf7-pw75-7wcp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-53629","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:28.263","lastModified":"2026-09-25T20:17:07.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"glpi-project","product":"glpi","versions":[{"version":">= 9.4.0, < 10.0.26","status":"affected"},{"version":">= 11.0.0, < 11.0.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:45:11.103391Z","id":"CVE-2026-53629","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/glpi-project/glpi/commit/1296798fb03295d07c1d97fa8483d1dbab59fef5","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/commit/80b86c0dcad2f6ece9b5da445d1c264a1dda3ce5","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/10.0.26","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-cpcj-x335-5cmh","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-55214","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:38.160","lastModified":"2026-09-29T18:17:16.297","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"glpi-project","product":"glpi","versions":[{"version":">= 11.0.6, < 11.0.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:58:35.910400Z","id":"CVE-2026-55214","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-116"}]}],"references":[{"url":"https://github.com/glpi-project/glpi/commit/970786ed3b817c4c2bf90b8457b024ec566b1bfc","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-8v8p-w8mq-wqcg","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-55217","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:38.323","lastModified":"2026-09-25T19:17:38.447","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0.8 and 10.0.26."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"glpi-project","product":"glpi","versions":[{"version":">= 0.85, < 10.0.26","status":"affected"},{"version":">= 11.0.0, < 11.0.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:04:33.228230Z","id":"CVE-2026-55217","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/glpi-project/glpi/commit/1cbf69b99dfd0610f1c03a3f245f3b248e1bfde0","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/commit/9c29f25bd09eca9e62ca50c52b3ebd15b02997b2","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/10.0.26","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-xm3v-3g6q-g9q8","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61855","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:53.963","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid (\"Good\") PGP signature from a registered sender key, even though the displayed message content is not actually covered by that signature. As a result, the inbound article may be stored with a successful signature status that does not reflect the authenticity of the shown content. This can mislead agents who rely on the signature indicator when assessing the trustworthiness of incoming mail. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:02:32.825707Z","id":"CVE-2026-61855","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/dd22716ced9f18861ed6f3b326c9d332c8c2072d","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-r957-vp26-563q","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-63006","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:54.500","lastModified":"2026-09-29T19:17:26.217","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected API endpoint and sends the request with the agent's session cookie, enabling side effects such as forced logout without any user interaction. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T18:03:28.018447Z","id":"CVE-2026-63006","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/856af85c12413087d6a74ffee25b16048a5ed8c3","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-33p2-cm7w-62g3","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-63204","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:54.667","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run belongs to a ticket the agent is not authorized to access. The disclosure is limited to the provider error string; ticket content is not exposed. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:41:35.372679Z","id":"CVE-2026-63204","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/849191c32a76f62fbd7cf4582a2b1e05e25f25ed","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-75j9-hpg4-j9f8","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-63205","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:54.837","lastModified":"2026-09-29T20:17:21.623","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline images referenced in the signature body. If a signature body contains an HTML img tag pointing to any existing attachment, the system copies that attachment into a new signature-owned record, without checking whether the user has permission to access the original attachment. The newly created copy is then downloadable by the same channel-admin user, because attachment access is determined by the copy's owner (the signature), not the original object (e.g., a ticket or knowledge-base article). This allows a user with any of the admin.channel_email, admin.channel_google, admin.channel_microsoft365, or admin.channel_microsoft_graph permissions to read attachments they would otherwise be denied access to, such as ticket attachments belonging to groups they are not a member of. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:40:24.888341Z","id":"CVE-2026-63205","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/f3e4da83621efad8443a4e9fe6bd87befad47c44","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-pp8r-x7pp-5qj5","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-63206","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:54.993","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme (for example a shortened HTTP URL instead of a shortened HTTP URL). Modern browsers treat both forms as equivalent remote URLs. As a result, an attacker who sends a crafted email or ticket can cause the recipient's browser to silently load an image from an external server, revealing when and by whom the ticket was opened. Zammad's \"remote content blocked\" warning is not shown because the sanitizer does not recognize the shortened form as remote. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:46:26.256481Z","id":"CVE-2026-63206","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-184"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/a5878f37e4010f0b3bec85dae35af964cc1c8019","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-fpwp-w2p4-hqg7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-63207","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:55.160","lastModified":"2026-09-29T19:17:26.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured secrets can be returned in plain text instead of the expected masked placeholder. Both the LDAP and Exchange integrations are affected. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T18:05:30.694506Z","id":"CVE-2026-63207","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-312"},{"lang":"en","value":"CWE-522"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/fab2e2e9dac97b298d2c0f84b526aae2b1e6afab","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-48h2-wv8r-fgp9","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-63208","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:55.347","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the token format Microsoft uses (JWT), only the first part is hidden, while the remaining parts remain readable in plain text. A Zammad admin with Microsoft Graph channel access can view these logs and see the partial token, which may reveal sensitive claims such as the account scope, tenant, or timing, and could assist in reconstructing the full token while it is still valid. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:42:05.383785Z","id":"CVE-2026-63208","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-116"},{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/2be46473eee405cc65b86a85d17059802e658532","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-qh8m-g5vr-7272","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-63216","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:55.517","lastModified":"2026-09-29T20:17:21.753","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the option label is output as raw HTML without escaping. An attacker who can control an option label, for example by setting a malicious string as a user or organization name used in a relation attribute, or by supplying a crafted custom attribute option value, can inject arbitrary HTML and JavaScript. The payload executes in the browser of any admin or agent who opens the affected object attribute configuration view. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:41:30.718327Z","id":"CVE-2026-63216","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/74b4fd4db62dc3652bb9db24096a2fbd1b56dc7f","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-r95m-ghj7-646x","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-84458","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:57.130","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the \"Automatic account link on initial logon\" setting is enabled, Zammad binds an incoming third-party (SSO) identity to an existing local account by matching the email address the identity provider reports, without verifying that the provider actually confirmed ownership of that email. An attacker who controls any identity at a configured provider, including, by default, any Azure AD tenant via Zammad's multi-tenant Microsoft 365 /common app registration, can set that identity's email to a victim's address, authenticate, and be logged in as the victim. This bypasses the victim's local password entirely and affects any existing account, including agents and administrators. Zammad will honor the xms_edov ID token claim when email verification is required in the Microsoft 365 setting, treating a missing claim as unverified. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:04:52.695359Z","id":"CVE-2026-84458","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/0dba387df8e2b46956907975034cd44e4d021b1c","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-86cc-3ggh-mf2m","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-84460","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:57.307","lastModified":"2026-09-29T19:17:26.907","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization feature and may contain sensitive labels. Ticket IDs are sequential integers, making bulk enumeration straightforward. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T18:08:23.146416Z","id":"CVE-2026-84460","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/13217eb6b3fdf350228b13f8cf69f640b8fd0da2","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/commit/d1a5eabdd1285b202f75761c4406edc5509e217e","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-6vgm-xxp4-p6jv","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-84461","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:57.467","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses for any account without triggering Zammad's normal lockout or rate limiting. The response also revealed whether a guess was correct, even before two-factor authentication was checked. This made it possible to brute-force weak or reused passwords. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:41:07.364423Z","id":"CVE-2026-84461","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-203"},{"lang":"en","value":"CWE-307"},{"lang":"en","value":"CWE-799"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/d51254f1c6da13f6ee27636a5c82e53f7e59666b","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-6vh5-pfp2-5rmh","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-84463","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:57.763","lastModified":"2026-09-29T20:17:27.777","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML without being escaped for its attribute context, allowing it to break out and inject additional HTML into the page. When another user who has permission to switch between user sessions views the affected answer, the injected HTML causes their browser to silently send a request to Zammad's session-switching endpoint using their own active credentials. This results in switching their session to an account chosen by the person who wrote the Knowledge Base answer. No action is required from the viewer beyond opening the published answer. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T19:42:36.719367Z","id":"CVE-2026-84463","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-838"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/f7a97ea209696bce85ed62901ee753b88368851c","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-cxjg-4gmf-5xqc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-84464","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:57.917","lastModified":"2026-09-28T14:45:39.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including its details in a request to that external system. An authenticated user, including one with only basic customer access, could exploit this by referencing another record's ID, and thereby view details of tickets, customer accounts, teams, or organizations that did not belong to them. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T19:03:37.637657Z","id":"CVE-2026-84464","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/34bdf46273adbea03821ac7157c8beaacde03a4b","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-jvm2-cr58-4qxp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-84465","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T19:17:58.123","lastModified":"2026-09-29T19:17:27.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is already stored in the system. An attacker can create their own certificate using the name of a real, previously trusted sender and use it to send a forged email. Zammad will display that email with the same \"validly signed\" indicator as a genuine message from the real sender, even though the attacker never had access to that sender's actual certificate or private key. This issue is fixed in version 7.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zammad","product":"zammad","versions":[{"version":"< 7.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T18:07:09.159774Z","id":"CVE-2026-84465","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"},{"lang":"en","value":"CWE-295"},{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://github.com/zammad/zammad/commit/9a07d0b8214ac4e8e10c23fce71d613bd0625524","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-m9ff-hjr3-93h4","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-97060","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T19:17:59.110","lastModified":"2026-09-29T19:17:39.087","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"yzcheng90","product":"X-SpringBoot","defaultStatus":"unaffected","repo":"https://github.com/yzcheng90/X-SpringBoot","packageURL":"pkg:github/yzcheng90/X-SpringBoot","versions":[{"version":"0","lessThanOrEqual":"6.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T18:22:06.958785Z","id":"CVE-2026-97060","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/03_user-admin-cross-object-bola.py","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yzcheng90/X-SpringBoot","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/sys/controller/SysUserController.java#L190-L216","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/x-springboot-through-6.0-authorization-bypass-via-user-management","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-97063","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T19:17:59.267","lastModified":"2026-09-28T20:53:43.443","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"yzcheng90","product":"X-SpringBoot","defaultStatus":"unaffected","repo":"https://github.com/yzcheng90/X-SpringBoot","packageURL":"pkg:github/yzcheng90/X-SpringBoot","versions":[{"version":"0","lessThanOrEqual":"6.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:39:54.574411Z","id":"CVE-2026-97063","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/02_sms-code-account-takeover.py","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yzcheng90/X-SpringBoot","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/sys/controller/SysLoginController.java#L94-L134","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/x-springboot-through-6.0-authentication-bypass-via-login-code","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-97064","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T19:17:59.427","lastModified":"2026-09-30T18:18:44.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint with a known email or mobile number."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"yzcheng90","product":"X-SpringBoot","defaultStatus":"unaffected","repo":"https://github.com/yzcheng90/X-SpringBoot","packageURL":"pkg:github/yzcheng90/X-SpringBoot","versions":[{"version":"0","lessThanOrEqual":"6.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:48:46.825889Z","id":"CVE-2026-97064","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1392"}]}],"references":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/02_sms-code-account-takeover.py","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yzcheng90/X-SpringBoot","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/doc/x_springboot.sql#L147","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/sys/controller/SysLoginController.java#L94-L112","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/x-springboot-through-6.0-authentication-bypass-via-static-master-code","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-97895","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T19:17:59.727","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role_id can lead to improper privilege management. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.2.6 is able to mitigate this issue. This patch is called 5469d70336fbb25e8e513683e82b32982ce8aa82. Upgrading the affected component is advised."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"krayin","product":"laravel-crm","cpes":["cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:*"],"modules":["User Management"],"versions":[{"version":"2.2.0","status":"affected"},{"version":"2.2.1","status":"affected"},{"version":"2.2.2","status":"affected"},{"version":"2.2.3","status":"affected"},{"version":"2.2.4","status":"affected"},{"version":"2.2.5","status":"affected"},{"version":"2.2.6","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:40:31.758418Z","id":"CVE-2026-97895","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/carlosalbertotuma/advisory/blob/main/advisory-01-privesc.md","source":"cna@vuldb.com"},{"url":"https://github.com/krayin/laravel-crm/","source":"cna@vuldb.com"},{"url":"https://github.com/krayin/laravel-crm/commit/5469d70336fbb25e8e513683e82b32982ce8aa82","source":"cna@vuldb.com"},{"url":"https://github.com/krayin/laravel-crm/issues/2616","source":"cna@vuldb.com"},{"url":"https://github.com/krayin/laravel-crm/pull/2621","source":"cna@vuldb.com"},{"url":"https://github.com/krayin/laravel-crm/releases/tag/v2.2.6","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97895","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/915369","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409907","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409907/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97896","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T19:17:59.967","lastModified":"2026-09-30T01:16:38.230","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.6 is able to resolve this issue. The identifier of the patch is b9836530ec9f5ef0f51653bb0cbbc47ef7184f51. It is advisable to upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"krayin","product":"laravel-crm","cpes":["cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:*"],"modules":["Upload Functionality"],"versions":[{"version":"2.2.0","status":"affected"},{"version":"2.2.1","status":"affected"},{"version":"2.2.2","status":"affected"},{"version":"2.2.3","status":"affected"},{"version":"2.2.4","status":"affected"},{"version":"2.2.5","status":"affected"},{"version":"2.2.6","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:01:46.346618Z","id":"CVE-2026-97896","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/carlosalbertotuma/advisory/blob/main/advisory-02-config-upload-xss.md","source":"cna@vuldb.com"},{"url":"https://github.com/krayin/laravel-crm/","source":"cna@vuldb.com"},{"url":"https://github.com/krayin/laravel-crm/commit/b9836530ec9f5ef0f51653bb0cbbc47ef7184f51","source":"cna@vuldb.com"},{"url":"https://github.com/krayin/laravel-crm/issues/2617","source":"cna@vuldb.com"},{"url":"https://github.com/krayin/laravel-crm/pull/2620","source":"cna@vuldb.com"},{"url":"https://github.com/krayin/laravel-crm/releases/tag/v2.2.6","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97896","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/915399","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409908","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409908/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97897","sourceIdentifier":"cna@vuldb.com","published":"2026-09-25T19:18:00.170","lastModified":"2026-09-29T18:17:32.423","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 is capable of addressing this issue. The patch is identified as 734aa10ae6c2ffa4c96c8869a89aa66940e4d345. You should upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Krayin","product":"laravel-crm","cpes":["cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:*"],"modules":["TinyMCE Media Upload"],"versions":[{"version":"2.2.0","status":"affected"},{"version":"2.2.1","status":"affected"},{"version":"2.2.2","status":"affected"},{"version":"2.2.3","status":"affected"},{"version":"2.2.4","status":"affected"},{"version":"2.2.5","status":"affected"},{"version":"2.2.6","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:52:12.671880Z","id":"CVE-2026-97897","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/carlosalbertotuma/advisory/blob/main/advisory-03-stored-xss-tinymce-media-upload.md","source":"cna@vuldb.com"},{"url":"https://github.com/krayin/laravel-crm/","source":"cna@vuldb.com"},{"url":"https://github.com/krayin/laravel-crm/commit/734aa10ae6c2ffa4c96c8869a89aa66940e4d345","source":"cna@vuldb.com"},{"url":"https://github.com/krayin/laravel-crm/pull/2639","source":"cna@vuldb.com"},{"url":"https://github.com/krayin/laravel-crm/releases/tag/v2.2.6","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97897","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/915413","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409909","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409909/cti","source":"cna@vuldb.com"},{"url":"https://github.com/carlosalbertotuma/advisory/blob/main/advisory-03-stored-xss-tinymce-media-upload.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100208","sourceIdentifier":"secure@microsoft.com","published":"2026-09-25T20:17:04.760","lastModified":"2026-10-20T19:49:39.833","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft 365 Apps for Enterprise","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.1","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2021","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.1","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2024","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.0","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T00:00:00+00:00","id":"CVE-2026-100208","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13"}]}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100208","source":"secure@microsoft.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100310","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T20:17:05.833","lastModified":"2026-09-30T17:31:44.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a directory containing a malicious plugin that executes arbitrary code with elevated privileges when loaded by a setuid or setgid program."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"GNU","product":"libextractor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.16","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:05:41.549904Z","id":"CVE-2026-100310","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-426"}]}],"references":[{"url":"https://ftp.gnu.org/gnu/libextractor/","source":"disclosure@vulncheck.com"},{"url":"https://git.gnunet.org/gnunet/libextractor/commit/6edfa653c048800e24a17f7e8cc2bb42659b8d01.html","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Haitam-lazaar/libextractor-privesc","source":"disclosure@vulncheck.com"},{"url":"https://www.gnu.org/software/libextractor/","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/gnu-libextractor-before-1.16-privilege-escalation-via-libextractor-prefix","source":"disclosure@vulncheck.com"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/25/25","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-100368","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T20:17:05.990","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"CliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specializations` packages provide specialized wrappers for shells such as PowerShell and Windows Command Prompt. `CliInvoke.Specializations` versions 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, 3.0.0-alpha.1 through 3.0.0-alpha.4, and 3.0.0-alpha.8 through 3.0.0-alpha.10, as well as `AlastairLundy.CliInvoke.Specializations` versions 1.0.0-rc.1 through 1.6.1.1, contain an OS command injection vulnerability in their PowerShell and Cmd wrappers. The wrappers pass a caller-controlled target and arguments to `pwsh -Command` or `cmd /c` using a single `ProcessStartInfo.Arguments` string, allowing a double quote in untrusted input to break operating-system-level quoting and cause the shell to execute an additional command with the host process's privileges. The vulnerability is patched in `CliInvoke.Specializations` versions 2.8.5, 2.9.4, 2.10.5, and 3.0.0-beta.1, and in `AlastairLundy.CliInvoke.Specializations` version 2.0.2. No complete workaround is available; users unable to upgrade should reject or remove double quotes from target paths and arguments, additionally reject shell metacharacters in versions 2.2.0 through 2.9.2 and 3.0.0-alpha.1 through 3.0.0-alpha.4, or bypass the PowerShell and Cmd wrappers and invoke target processes directly when handling untrusted input."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"alastairlundy","product":"CliInvoke.Specializations","versions":[{"version":">= 2.2.0, <= 2.8.4","status":"affected"},{"version":">= 2.9.0, <= 2.9.3","status":"affected"},{"version":">= 2.10.0, <= 2.10.4","status":"affected"},{"version":">= 3.0.0-alpha.1, <= 3.0.0-alpha.4","status":"affected"},{"version":">= 3.0.0-alpha.8, <= 3.0.0-alpha.10","status":"affected"},{"version":">= 1.0.0-rc.1, <= 1.6.1.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:06:37.206021Z","id":"CVE-2026-100368","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/alastairlundy/CliInvoke/security/advisories/GHSA-wrvw-254r-wpmv","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-100372","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T20:17:06.143","lastModified":"2026-09-30T16:31:54.923","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with manage_template_access permission can traverse outside the layout directory to modify executable PHP files and achieve remote code execution as the web server user."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"MacWarrior","product":"clipbucket-v5","defaultStatus":"unaffected","packageURL":"pkg:github/MacWarrior/clipbucket-v5","versions":[{"version":"0","lessThan":"5.5.3-#197","versionType":"custom","status":"affected"},{"version":"5.5.3-#197","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:48:12.777653Z","id":"CVE-2026-100372","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/MacWarrior/clipbucket-v5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/MacWarrior/clipbucket-v5/blob/61cce55ab26ef88fb782dfde47b44c17c56978cd/upload/admin_area/template_editor.php#L44-L69","source":"disclosure@vulncheck.com"},{"url":"https://github.com/MacWarrior/clipbucket-v5/commit/f31de49b2194482ffef7147aa1e9b1c8f0f04eb7","source":"disclosure@vulncheck.com"},{"url":"https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.3-%23197","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/S1AIRjzqfx","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/clipbucket-v5-before-5.5.3-197-path-traversal-via-template-editor-php","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100373","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T20:17:06.293","lastModified":"2026-09-25T21:17:21.393","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"open-metadata","product":"OpenMetadata","defaultStatus":"unaffected","packageURL":"pkg:github/open-metadata/OpenMetadata","versions":[{"version":"0","lessThanOrEqual":"2.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T20:37:13.790472Z","id":"CVE-2026-100373","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://gist.github.com/naif-alfardan/8a69e0648e11b07abe63f949346179c1","source":"disclosure@vulncheck.com"},{"url":"https://github.com/open-metadata/OpenMetadata","source":"disclosure@vulncheck.com"},{"url":"https://github.com/open-metadata/OpenMetadata/blob/2.0.2-release/openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java#L34-L47","source":"disclosure@vulncheck.com"},{"url":"https://github.com/open-metadata/OpenMetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","source":"disclosure@vulncheck.com"},{"url":"https://github.com/open-metadata/OpenMetadata/issues/32592","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openmetadata-through-2.0.2-ssrf-via-webhook-url-validation-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-53990","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T20:17:07.813","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-57861","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T20:17:09.270","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-5267","sourceIdentifier":"7bd90cf1-1651-495e-9ae8-9415fb3c9feb","published":"2026-09-25T20:17:11.613","lastModified":"2026-09-28T16:31:16.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ciena Navigator Network\nControl Suite (NCS) contains an information exposure vulnerability in an\nevent-streaming API that does not properly enforce authentication. An\nunauthenticated attacker with network access to the affected service could\naccess the event stream and potentially obtain sensitive information."}],"affected":[{"source":"7bd90cf1-1651-495e-9ae8-9415fb3c9feb","affectedData":[{"vendor":"Ciena","product":"Navigator NCS","defaultStatus":"unaffected","versions":[{"version":"7.2 and any older release","status":"affected"},{"version":"7.2-P01 through 7.2-P07","status":"affected"},{"version":"8.0","status":"affected"},{"version":"8.0-P01 through 8.0-P06A","status":"affected"},{"version":"8.1","status":"affected"},{"version":"8.1-P01 through 8.1-P06","status":"affected"},{"version":"8.2","status":"affected"},{"version":"8.2-P01 through 8.2-P06","status":"affected"},{"version":"9.0","status":"affected"},{"version":"9.0-P01 through 9.0-P05A","status":"affected"},{"version":"9.1","status":"affected"},{"version":"9.1-P01 through 9.1-P05","status":"affected"},{"version":"9.2","status":"affected"},{"version":"9.2-P01 through 9.2-P02","status":"affected"},{"version":"10.0","status":"affected"},{"version":"10.0-P01 through 10.0-P01B","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T20:40:10.302755Z","id":"CVE-2026-5267","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"7bd90cf1-1651-495e-9ae8-9415fb3c9feb","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://www.ciena.com/product-security","source":"7bd90cf1-1651-495e-9ae8-9415fb3c9feb"}]}},{"cve":{"id":"CVE-2026-93682","sourceIdentifier":"security@php.net","published":"2026-09-25T20:17:47.597","lastModified":"2026-10-23T14:58:22.930","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory."}],"affected":[{"source":"security@php.net","affectedData":[{"vendor":"PHP Group","product":"PHP","defaultStatus":"unaffected","packageName":"ext-standard","versions":[{"version":"8.2.*","lessThan":"8.2.34","versionType":"semver","status":"affected"},{"version":"8.3.*","lessThan":"8.3.35","versionType":"semver","status":"affected"},{"version":"8.4.*","lessThan":"8.4.26","versionType":"semver","status":"affected"},{"version":"8.5.*","lessThan":"8.5.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@php.net","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T20:37:51.434446Z","id":"CVE-2026-93682","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@php.net","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.2.0","versionEndExcluding":"8.2.34","matchCriteriaId":"AAFB3643-4D71-46ED-8184-DDE5FE41CD02"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.3.0","versionEndExcluding":"8.3.35","matchCriteriaId":"FF664EE8-D417-45A4-84DF-158F5073FDE8"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.4.0","versionEndExcluding":"8.4.26","matchCriteriaId":"52D4BECA-EF0D-4180-837C-AEFA7A12D243"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.0","versionEndExcluding":"8.5.11","matchCriteriaId":"308803C0-9FC8-40D2-8920-B83BCC48014F"}]}]}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f","source":"security@php.net","tags":["Vendor Advisory","Exploit"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory","Exploit"]}]}},{"cve":{"id":"CVE-2026-96875","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-25T20:17:47.800","lastModified":"2026-09-29T22:19:06.197","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS.\n\n\nThis issue affects Mediawiki - Cargo extension: through 3.9.4."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - Cargo extension","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.9.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T20:39:00.566462Z","id":"CVE-2026-96875","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328629","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T435206#12360644","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-96876","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-25T20:17:47.933","lastModified":"2026-09-29T22:19:06.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS.\n\nThis issue affects Mediawiki - Cargo extension: through 3.9.4."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - Cargo extension","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.9.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T20:38:36.379087Z","id":"CVE-2026-96876","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328630","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T435121","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-96877","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-25T20:17:48.053","lastModified":"2026-09-29T22:19:06.460","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS.\n\nThis issue affects Mediawiki - Cargo extension: through 3.9.4."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - Cargo extension","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.9.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T20:05:35.671289Z","id":"CVE-2026-96877","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328628","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T434977","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-96878","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-25T20:17:48.180","lastModified":"2026-09-29T22:19:06.600","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS.\n\nThis issue affects Mediawiki - Cargo extension: through 3.9.4."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - Cargo extension","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.9.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T20:05:20.312201Z","id":"CVE-2026-96878","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328627","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T434784","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2025-14181","sourceIdentifier":"security@php.net","published":"2026-09-25T21:17:19.840","lastModified":"2026-10-23T14:56:56.713","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."},{"lang":"es","value":"El cliente SOAP HTTP protege el crecimiento de su búfer de respuesta con una comprobación que se basa en un desbordamiento de entero con signo, lo cual es un comportamiento indefinido y no se garantiza que se active. Cuando la comprobación se optimiza y elimina, un servidor SOAP malicioso puede hacer que el cliente asigne un búfer mucho más pequeño que los datos que luego escribe en él, produciendo un desbordamiento de búfer en el montón."}],"affected":[{"source":"security@php.net","affectedData":[{"vendor":"PHP Group","product":"PHP","defaultStatus":"unaffected","packageName":"ext-soap","versions":[{"version":"8.2.*","lessThan":"8.2.34","versionType":"semver","status":"affected"},{"version":"8.3.*","lessThan":"8.3.35","versionType":"semver","status":"affected"},{"version":"8.4.*","lessThan":"8.4.26","versionType":"semver","status":"affected"},{"version":"8.5.*","lessThan":"8.5.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@php.net","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T20:43:53.478398Z","id":"CVE-2025-14181","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@php.net","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.2.0","versionEndExcluding":"8.2.34","matchCriteriaId":"AAFB3643-4D71-46ED-8184-DDE5FE41CD02"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.3.0","versionEndExcluding":"8.3.35","matchCriteriaId":"FF664EE8-D417-45A4-84DF-158F5073FDE8"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.4.0","versionEndExcluding":"8.4.26","matchCriteriaId":"52D4BECA-EF0D-4180-837C-AEFA7A12D243"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.0","versionEndExcluding":"8.5.11","matchCriteriaId":"308803C0-9FC8-40D2-8920-B83BCC48014F"}]}]}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv","source":"security@php.net","tags":["Vendor Advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2025-1218","sourceIdentifier":"security@php.net","published":"2026-09-25T21:17:20.993","lastModified":"2026-10-23T14:55:37.780","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."},{"lang":"es","value":"El analizador del protocolo de conexión de mysqlnd lee campos de los paquetes del servidor antes de verificar que el paquete aún contiene suficientes bytes para ellos. Un servidor MySQL malicioso o comprometido puede enviar un paquete truncado y hacer que el cliente lea más allá del final del búfer del paquete, lo que es un comportamiento indefinido y puede provocar la caída del proceso."}],"affected":[{"source":"security@php.net","affectedData":[{"vendor":"PHP Group","product":"PHP","defaultStatus":"unaffected","packageName":"ext-mysqlnd","versions":[{"version":"8.2.*","lessThan":"8.2.34","versionType":"semver","status":"affected"},{"version":"8.3.*","lessThan":"8.3.35","versionType":"semver","status":"affected"},{"version":"8.4.*","lessThan":"8.4.26","versionType":"semver","status":"affected"},{"version":"8.5.*","lessThan":"8.5.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@php.net","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":3.4,"baseSeverity":"LOW","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T12:56:30.325753Z","id":"CVE-2025-1218","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@php.net","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.2.0","versionEndExcluding":"8.2.34","matchCriteriaId":"AAFB3643-4D71-46ED-8184-DDE5FE41CD02"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.3.0","versionEndExcluding":"8.3.35","matchCriteriaId":"FF664EE8-D417-45A4-84DF-158F5073FDE8"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.4.0","versionEndExcluding":"8.4.26","matchCriteriaId":"52D4BECA-EF0D-4180-837C-AEFA7A12D243"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.0","versionEndExcluding":"8.5.11","matchCriteriaId":"308803C0-9FC8-40D2-8920-B83BCC48014F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7","source":"security@php.net","tags":["Vendor Advisory","Exploit"]}]}},{"cve":{"id":"CVE-2026-100369","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T21:17:21.247","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libraries for invoking command-line programs and wrapping executable processes. `CliInvoke` versions 2.0.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, and 3.0.0-alpha.1 through 3.0.0-beta.1, as well as `AlastairLundy.CliInvoke` versions 2.0.0-alpha.1 through 2.0.0, contain an argument-injection vulnerability in `RunnerProcessFactory` on the 2.x line and `RunnerConfigurationFactory` on the 3.x line. These factories combine runner arguments, a caller-controlled target, and caller-controlled arguments into one `ProcessStartInfo.Arguments` string, allowing a double quote in the target or an argument to terminate an operating-system-level quoted region and inject unintended elements into the runner’s argument vector, potentially resulting in arbitrary command execution when a shell runner is used. The vulnerability is patched in `CliInvoke` versions 2.8.5, 2.9.4, 2.10.5, and 3.0.0-beta.2, and in `AlastairLundy.CliInvoke` version 2.0.2. No complete workaround is available; users unable to upgrade can partially mitigate the issue by removing double quotes from targets and arguments, additionally removing shell metacharacters when using shell runners, or bypassing the vulnerable factory and constructing a `ProcessConfiguration` with an explicit `ArgumentList`."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"alastairlundy","product":"CliInvoke","versions":[{"version":">= 2.0.0, <= 2.8.4","status":"affected"},{"version":">= 2.9.0, <= 2.9.3","status":"affected"},{"version":">= 2.10.0, <= 2.10.4","status":"affected"},{"version":">= 3.0.0-alpha.1, <= 3.0.0-beta.1","status":"affected"}]},{"vendor":"alastairlundy","product":"AlastairLundy.CliInvoke","versions":[{"version":">= 2.0.0-alpha.1, <= 2.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T13:42:51.617325Z","id":"CVE-2026-100369","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://github.com/alastairlundy/CliInvoke/security/advisories/GHSA-j73w-8hfr-4gc9","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-100376","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-25T21:17:21.517","lastModified":"2026-09-28T16:38:10.183","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting (XSS).\n\nThis issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"Wikimedia Foundation","product":"Mediawiki - TemplateSandbox Extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/g/mediawiki/extensions/TemplateSandbox/+/refs/heads/master","versions":[{"version":"*","lessThan":"1.46.1, 1.45.5, 1.43.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:42:29.346400Z","id":"CVE-2026-100376","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/I6630b9915f640bf75c8570165eb8728bd7a2c07a","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T430596","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-100377","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-25T21:17:21.650","lastModified":"2026-09-28T16:38:10.183","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation.\n\nThis issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"Wikimedia Foundation","product":"Mediawiki - WikiLambda Extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/g/mediawiki/extensions/WikiLambda/+/refs/heads/master","versions":[{"version":"1.47.0-alpha","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:42:19.808242Z","id":"CVE-2026-100377","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikiLambda/+/1320186","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T430601","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-100378","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-25T21:17:21.780","lastModified":"2026-09-28T16:38:10.183","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Mediawiki - Translate Extension: from * before 1.46.1, 1.45.5, 1.43.10."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"Wikimedia Foundation","product":"Mediawiki - Translate Extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/g/mediawiki/extensions/Translate/+/refs/heads/master","versions":[{"version":"*","lessThan":"1.46.1, 1.45.5, 1.43.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:42:38.694430Z","id":"CVE-2026-100378","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/I9b74c849b223f18955b42779f5ffbd1e051e415c","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T433070","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-100379","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-25T21:17:21.910","lastModified":"2026-09-28T16:38:10.183","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies.\n\nThis issue affects Wikipedia Android App: main."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"Wikimedia Foundation","product":"Wikipedia Android App","defaultStatus":"unaffected","repo":"https://github.com/wikimedia/apps-android-wikipedia","versions":[{"version":"main","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:42:57.734479Z","id":"CVE-2026-100379","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/wikimedia/apps-android-wikipedia/pull/6768","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T433832","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-100380","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-25T21:17:22.037","lastModified":"2026-09-28T16:38:10.183","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).\n\nThis issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"Wikimedia Foundation","product":"Mediawiki - Wikibase Extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/g/mediawiki/extensions/Wikibase/+/refs/heads/master","versions":[{"version":"*","lessThan":"1.46.1, 1.45.5, 1.43.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:43:05.441903Z","id":"CVE-2026-100380","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/I7407f9748d72161ce25ad0ba2446869bb1776857","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T434549","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-100387","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T21:17:22.163","lastModified":"2026-09-30T18:17:59.007","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users to read adjacent heap memory. Attackers can supply crafted pcpatch values with attacker-controlled size fields to copy heap memory into stored patches for exfiltration or crash the PostgreSQL backend."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"pgpointcloud","product":"pointcloud","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.2.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:49:57.088943Z","id":"CVE-2026-100387","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/pgpointcloud/pointcloud","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pgpointcloud/pointcloud/blob/v1.2.5/lib/pc_bytes.c#L1347-L1373","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pgpointcloud/pointcloud/issues/387","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pgpointcloud/pointcloud/pull/388","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/pgpointcloud-through-1.2.5-heap-out-of-bounds-read-via-wkb-deserialization","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100388","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T21:17:22.317","lastModified":"2026-09-30T01:16:32.173","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied files and contents from the process-wide clipboard cache."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"rustdesk","product":"rustdesk","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.5.0","versionType":"semver","status":"affected"},{"version":"1.5.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:07:58.490575Z","id":"CVE-2026-100388","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/rustdesk/rustdesk","source":"disclosure@vulncheck.com"},{"url":"https://github.com/rustdesk/rustdesk/blob/1.4.9/src/server/connection.rs#L3074-L3092","source":"disclosure@vulncheck.com"},{"url":"https://github.com/rustdesk/rustdesk/commit/f299fb9906006247863250d7dfaa016f29eef7a4","source":"disclosure@vulncheck.com"},{"url":"https://github.com/rustdesk/rustdesk/pull/16333","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/rustdesk-before-1.5.0-missing-authorization-check-on-incoming-file-clipboard-messages","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100389","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T21:17:22.483","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket directory and executed when accessed."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"GestSup","product":"GestSup","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.2.62","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T18:20:51.345488Z","id":"CVE-2026-100389","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/","source":"disclosure@vulncheck.com"},{"url":"https://gestsup.fr/index.php?page=changelog","source":"disclosure@vulncheck.com"},{"url":"https://gestsup.fr/index.php?page=download","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/gestsup-before-3.2.61-remote-code-execution-via-imap-attachment","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100390","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T21:17:22.637","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"tobychui","product":"zoraxy","defaultStatus":"unaffected","versions":[{"version":"3.2.3","lessThanOrEqual":"3.3.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T20:42:41.262458Z","id":"CVE-2026-100390","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://github.com/tobychui/zoraxy","source":"disclosure@vulncheck.com"},{"url":"https://github.com/tobychui/zoraxy/blob/v3.3.4/src/mod/auth/sso/forward/util.go#L127-L142","source":"disclosure@vulncheck.com"},{"url":"https://github.com/tobychui/zoraxy/commit/56bb3e5abb83eae42a64203028d73a001d6096c4","source":"disclosure@vulncheck.com"},{"url":"https://github.com/tobychui/zoraxy/pull/1264","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/zoraxy-3.2.3-through-3.3.4-client-ip-spoofing-via-x-forwarded-for-ipv6","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100391","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T21:17:22.800","lastModified":"2026-10-05T15:17:08.547","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full responses from the proxy server."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"mhdzumair","product":"mediaflow-proxy","defaultStatus":"unaffected","packageURL":"pkg:pypi/mediaflow-proxy","versions":[{"version":"0","lessThanOrEqual":"2.4.9","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:00:45.519603Z","id":"CVE-2026-100391","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/mhdzumair/mediaflow-proxy","source":"disclosure@vulncheck.com"},{"url":"https://github.com/mhdzumair/mediaflow-proxy/blob/2.4.9/mediaflow_proxy/routes/proxy.py#L532-L569","source":"disclosure@vulncheck.com"},{"url":"https://github.com/mhdzumair/mediaflow-proxy/commit/99f4af1153d4766420a098a232183cba1efdc560","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/mediaflow-proxy-through-2.4.9-server-side-request-forgery-via-incomplete-validation","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100417","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T21:17:22.957","lastModified":"2026-09-30T01:16:32.313","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authenticated peers to read files from the host clipboard. Attackers can send FormatDataRequest and FileContentsRequest messages to retrieve copied files by guessing the FileGroupDescriptorW format identifier."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"rustdesk","product":"rustdesk","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.5.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:09:19.998405Z","id":"CVE-2026-100417","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/rustdesk/rustdesk","source":"disclosure@vulncheck.com"},{"url":"https://github.com/rustdesk/rustdesk/blob/1.4.9/libs/clipboard/src/windows/wf_cliprdr.c#L2728-L2770","source":"disclosure@vulncheck.com"},{"url":"https://github.com/rustdesk/rustdesk/blob/1.4.9/src/ui_cm_interface.rs#L618-L638","source":"disclosure@vulncheck.com"},{"url":"https://github.com/rustdesk/rustdesk/commit/f299fb9906006247863250d7dfaa016f29eef7a4","source":"disclosure@vulncheck.com"},{"url":"https://github.com/rustdesk/rustdesk/pull/16333","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/rustdesk-before-1.5.0-one-way-file-transfer-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-10758","sourceIdentifier":"psirt@esri.com","published":"2026-09-25T21:17:23.117","lastModified":"2026-09-30T19:56:45.443","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker controlled imagery to an application that uses LERC to crash the application, leading to a denial of service."}],"affected":[{"source":"psirt@esri.com","affectedData":[{"vendor":"Esri","product":"Lerc","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@esri.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:42:47.135270Z","id":"CVE-2026-10758","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@esri.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/Esri/lerc/security/advisories/GHSA-cw29-mw7w-pj37","source":"psirt@esri.com"}]}},{"cve":{"id":"CVE-2026-17545","sourceIdentifier":"security@php.net","published":"2026-09-25T21:17:23.253","lastModified":"2026-10-23T14:43:15.817","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}],"affected":[{"source":"security@php.net","affectedData":[{"vendor":"PHP Group","product":"PHP","defaultStatus":"unaffected","versions":[{"version":"8.2.*","lessThan":"8.2.34","versionType":"semver","status":"affected"},{"version":"8.3.*","lessThan":"8.3.35","versionType":"semver","status":"affected"},{"version":"8.4.*","lessThan":"8.4.26","versionType":"semver","status":"affected"},{"version":"8.5.*","lessThan":"8.5.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@php.net","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T20:43:10.043800Z","id":"CVE-2026-17545","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@php.net","type":"Secondary","description":[{"lang":"en","value":"CWE-67"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.2.0","versionEndExcluding":"8.2.34","matchCriteriaId":"AAFB3643-4D71-46ED-8184-DDE5FE41CD02"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.3.0","versionEndExcluding":"8.3.35","matchCriteriaId":"FF664EE8-D417-45A4-84DF-158F5073FDE8"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.4.0","versionEndExcluding":"8.4.26","matchCriteriaId":"52D4BECA-EF0D-4180-837C-AEFA7A12D243"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.0","versionEndExcluding":"8.5.11","matchCriteriaId":"308803C0-9FC8-40D2-8920-B83BCC48014F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp","source":"security@php.net","tags":["Vendor Advisory","Exploit"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory","Exploit"]}]}},{"cve":{"id":"CVE-2026-57443","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T21:17:23.413","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=[\"*\"]`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"issdandavis","product":"SCBE-AETHERMOORE","versions":[{"version":">= 4.0.2, < 4.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:44:13.690659Z","id":"CVE-2026-57443","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/issdandavis/SCBE-AETHERMOORE/commit/ca833795e01eab060e92572e5f667c0c136b8c1e","source":"security-advisories@github.com"},{"url":"https://github.com/issdandavis/SCBE-AETHERMOORE/commit/de7779b722c501dbcf4eae95dd51bb3984506fb1","source":"security-advisories@github.com"},{"url":"https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39","source":"security-advisories@github.com"},{"url":"https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-57864","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T21:17:23.560","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-6103","sourceIdentifier":"security@php.net","published":"2026-09-25T21:17:23.790","lastModified":"2026-10-23T14:07:18.323","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."}],"affected":[{"source":"security@php.net","affectedData":[{"vendor":"PHP Group","product":"PHP","defaultStatus":"unaffected","versions":[{"version":"8.2.*","lessThan":"8.2.34","versionType":"semver","status":"affected"},{"version":"8.3.*","lessThan":"8.3.35","versionType":"semver","status":"affected"},{"version":"8.4.*","lessThan":"8.4.26","versionType":"semver","status":"affected"},{"version":"8.5.*","lessThan":"8.5.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@php.net","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T20:41:05.626504Z","id":"CVE-2026-6103","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@php.net","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.2.0","versionEndExcluding":"8.2.34","matchCriteriaId":"AAFB3643-4D71-46ED-8184-DDE5FE41CD02"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.3.0","versionEndExcluding":"8.3.35","matchCriteriaId":"FF664EE8-D417-45A4-84DF-158F5073FDE8"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.4.0","versionEndExcluding":"8.4.26","matchCriteriaId":"52D4BECA-EF0D-4180-837C-AEFA7A12D243"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.0","versionEndExcluding":"8.5.11","matchCriteriaId":"308803C0-9FC8-40D2-8920-B83BCC48014F"}]}]}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85","source":"security@php.net","tags":["Vendor Advisory","Exploit"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory","Exploit"]}]}},{"cve":{"id":"CVE-2026-91765","sourceIdentifier":"security@php.net","published":"2026-09-25T21:17:24.550","lastModified":"2026-10-23T13:49:32.333","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."}],"affected":[{"source":"security@php.net","affectedData":[{"vendor":"PHP Group","product":"PHP","defaultStatus":"unaffected","packageName":"ext-soap","versions":[{"version":"8.2.*","lessThan":"8.2.34","versionType":"semver","status":"affected"},{"version":"8.3.*","lessThan":"8.3.35","versionType":"semver","status":"affected"},{"version":"8.4.*","lessThan":"8.4.26","versionType":"semver","status":"affected"},{"version":"8.5.*","lessThan":"8.5.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@php.net","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T12:56:08.183508Z","id":"CVE-2026-91765","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@php.net","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.2.0","versionEndExcluding":"8.2.34","matchCriteriaId":"AAFB3643-4D71-46ED-8184-DDE5FE41CD02"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.3.0","versionEndExcluding":"8.3.35","matchCriteriaId":"FF664EE8-D417-45A4-84DF-158F5073FDE8"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.4.0","versionEndExcluding":"8.4.26","matchCriteriaId":"52D4BECA-EF0D-4180-837C-AEFA7A12D243"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.0","versionEndExcluding":"8.5.11","matchCriteriaId":"308803C0-9FC8-40D2-8920-B83BCC48014F"}]}]}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm","source":"security@php.net","tags":["Vendor Advisory","Exploit"]}]}},{"cve":{"id":"CVE-2026-91766","sourceIdentifier":"security@php.net","published":"2026-09-25T21:17:24.673","lastModified":"2026-10-23T13:46:07.313","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."}],"affected":[{"source":"security@php.net","affectedData":[{"vendor":"PHP Group","product":"PHP","defaultStatus":"unaffected","packageName":"ext-standard","versions":[{"version":"8.2.*","lessThan":"8.2.34","versionType":"semver","status":"affected"},{"version":"8.3.*","lessThan":"8.3.35","versionType":"semver","status":"affected"},{"version":"8.4.*","lessThan":"8.4.26","versionType":"semver","status":"affected"},{"version":"8.5.*","lessThan":"8.5.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@php.net","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T12:56:20.823835Z","id":"CVE-2026-91766","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@php.net","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-522"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.2.0","versionEndExcluding":"8.2.34","matchCriteriaId":"AAFB3643-4D71-46ED-8184-DDE5FE41CD02"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.3.0","versionEndExcluding":"8.3.35","matchCriteriaId":"FF664EE8-D417-45A4-84DF-158F5073FDE8"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.4.0","versionEndExcluding":"8.4.26","matchCriteriaId":"52D4BECA-EF0D-4180-837C-AEFA7A12D243"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.0","versionEndExcluding":"8.5.11","matchCriteriaId":"308803C0-9FC8-40D2-8920-B83BCC48014F"}]}]}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92","source":"security@php.net","tags":["Vendor Advisory","Exploit"]}]}},{"cve":{"id":"CVE-2026-91767","sourceIdentifier":"security@php.net","published":"2026-09-25T21:17:24.793","lastModified":"2026-09-29T21:27:41.130","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}],"affected":[{"source":"security@php.net","affectedData":[{"vendor":"PHP Group","product":"PHP","defaultStatus":"unaffected","packageName":"ext-openssl","versions":[{"version":"8.2.*","lessThan":"8.2.34","versionType":"semver","status":"affected"},{"version":"8.3.*","lessThan":"8.3.35","versionType":"semver","status":"affected"},{"version":"8.4.*","lessThan":"8.4.26","versionType":"semver","status":"affected"},{"version":"8.5.*","lessThan":"8.5.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@php.net","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T12:56:38.307648Z","id":"CVE-2026-91767","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@php.net","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p","source":"security@php.net"}]}},{"cve":{"id":"CVE-2026-91769","sourceIdentifier":"security@php.net","published":"2026-09-25T21:17:24.913","lastModified":"2026-10-23T13:20:43.460","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}],"affected":[{"source":"security@php.net","affectedData":[{"vendor":"PHP Group","product":"PHP","defaultStatus":"unaffected","packageName":"ext-openssl","versions":[{"version":"8.2.*","lessThan":"8.2.34","versionType":"semver","status":"affected"},{"version":"8.3.*","lessThan":"8.3.35","versionType":"semver","status":"affected"},{"version":"8.4.*","lessThan":"8.4.26","versionType":"semver","status":"affected"},{"version":"8.5.*","lessThan":"8.5.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@php.net","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T12:56:47.310384Z","id":"CVE-2026-91769","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@php.net","type":"Secondary","description":[{"lang":"en","value":"CWE-297"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.2.0","versionEndExcluding":"8.2.34","matchCriteriaId":"AAFB3643-4D71-46ED-8184-DDE5FE41CD02"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.3.0","versionEndExcluding":"8.3.35","matchCriteriaId":"FF664EE8-D417-45A4-84DF-158F5073FDE8"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.4.0","versionEndExcluding":"8.4.26","matchCriteriaId":"52D4BECA-EF0D-4180-837C-AEFA7A12D243"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.0","versionEndExcluding":"8.5.11","matchCriteriaId":"308803C0-9FC8-40D2-8920-B83BCC48014F"}]}]}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx","source":"security@php.net","tags":["Vendor Advisory","Exploit"]}]}},{"cve":{"id":"CVE-2026-96879","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-25T21:17:25.613","lastModified":"2026-09-29T22:19:06.727","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - FlaggedRevs extension","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.46.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T20:41:45.708316Z","id":"CVE-2026-96879","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-212"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FlaggedRevs/+/1344737","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T433020","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-9313","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T21:17:25.757","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-100381","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-25T22:17:09.027","lastModified":"2026-09-28T16:38:10.183","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting (XSS).\n\nThis issue affects Mediawiki - UploadWizard Extension: from * before 1.46.1, 1.45.5, 1.43.10."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"Wikimedia Foundation","product":"Mediawiki - UploadWizard Extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/g/mediawiki/extensions/UploadWizard/+/refs/heads/master","versions":[{"version":"*","lessThan":"1.46.1, 1.45.5, 1.43.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:43:12.387227Z","id":"CVE-2026-100381","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/Iba914c0d7e86f9342ee9cecde3bee0806ec90c84","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T434619","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-100382","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-25T22:17:10.150","lastModified":"2026-09-28T16:38:10.183","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection.\n\nThis issue affects Mediawiki - ExternalData Extension: from * before 3.7."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"Wikimedia Foundation","product":"Mediawiki - ExternalData Extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/g/mediawiki/extensions/ExternalData/+/refs/heads/master","versions":[{"version":"*","lessThan":"3.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:43:20.551535Z","id":"CVE-2026-100382","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ExternalData/+/1326012","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T434961","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-100383","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-25T22:17:10.303","lastModified":"2026-09-28T16:38:10.183","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting (XSS).\n\nThis issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"Wikimedia Foundation","product":"Mediawiki - WikiLambda Extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/g/mediawiki/extensions/WikiLambda/+/refs/heads/master","versions":[{"version":"1.47.0-alpha","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:43:28.118353Z","id":"CVE-2026-100383","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikiLambda/+/1326391","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T434967","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-100418","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:10.447","lastModified":"2026-09-30T16:39:29.870","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single unauthenticated request to consume provider quota or access sensitive configuration data."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"pawelmalak","product":"flame","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.4.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:37:12.610139Z","id":"CVE-2026-100418","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/pawelmalak/flame","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/blob/3e03c25138df4321143c4fbd1a99468ff375ebb2/controllers/config/getConfig.js#L7-L13","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/blob/3e03c25138df4321143c4fbd1a99468ff375ebb2/routes/config.js#L14","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/blob/3e03c25138df4321143c4fbd1a99468ff375ebb2/utils/init/initialConfig.json#L2","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/issues/494","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/flame-through-2.4.0-information-exposure-via-get-api-config","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/issues/494","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100419","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:10.613","lastModified":"2026-09-28T14:17:09.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"GitoxideLabs","product":"gitoxide","defaultStatus":"unaffected","packageURL":"pkg:cargo/gix-fs","versions":[{"version":"0","lessThan":"0.23.0","versionType":"semver","status":"affected"},{"version":"0.23.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T13:05:49.724852Z","id":"CVE-2026-100419","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"references":[{"url":"https://github.com/GitoxideLabs/gitoxide","source":"disclosure@vulncheck.com"},{"url":"https://github.com/GitoxideLabs/gitoxide/blob/gix-fs-v0.22.1/gix-fs/src/stack.rs#L185-L196","source":"disclosure@vulncheck.com"},{"url":"https://github.com/GitoxideLabs/gitoxide/commit/b62498378b8bc2c95863a044b700f2063b0b5875","source":"disclosure@vulncheck.com"},{"url":"https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-6p9q-f2xg-6pr5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/gitoxide-gix-fs-before-0.23.0-worktree-escape-via-symlink","source":"disclosure@vulncheck.com"},{"url":"https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100501","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:10.793","lastModified":"2026-10-05T15:17:09.807","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt counters, lockouts, or delays to gain full administrator access and modify application configuration."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"pawelmalak","product":"flame","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.4.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:04:34.369718Z","id":"CVE-2026-100501","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-307"}]}],"references":[{"url":"https://github.com/pawelmalak/flame","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/blob/v2.4.0/.docker/Dockerfile#L28","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L11-L22","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/blob/v2.4.0/routes/auth.js#L7","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/issues/494","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/flame-through-2.4.0-brute-force-attack-via-login-endpoint","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100502","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:10.947","lastModified":"2026-09-30T16:39:29.870","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"pawelmalak","product":"flame","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.4.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.7,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:12:58.424687Z","id":"CVE-2026-100502","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://github.com/pawelmalak/flame","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L9-L17","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/blob/v2.4.0/utils/init/initSecret.js#L8-L25","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/blob/v2.4.0/utils/signToken.js#L4","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/issues/494","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/flame-through-2.4.0-admin-token-insufficient-session-expiration","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/issues/494","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-45234","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:11.103","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-45235","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:11.170","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-45236","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:11.227","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-45237","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:11.290","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-45238","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:11.350","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-45239","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:11.407","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-45240","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:11.470","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-45241","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:11.520","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-49117","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:11.657","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-49118","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:11.720","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-53971","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:11.897","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-53972","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:11.957","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-53973","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:17:12.007","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-63431","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T22:17:14.167","lastModified":"2026-09-30T01:16:37.963","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/component_views.py does not consistently authorize access in allowances_deductions_tab, view_single_allowance, and view_single_deduction before loading records selected by emp_id, allowance_id, or deduction_id. An authenticated employee can substitute those identifiers to read another employee's salary structure, allowance and deduction amounts, personal loan disbursements, and repayment schedules without owning the record or holding payroll-view permissions. No complete fixed version is available as of this review."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"horilla","product":"horilla-hr","versions":[{"version":"<= 1.5.0-85","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:11:03.661646Z","id":"CVE-2026-63431","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/horilla/horilla-hr/commit/a17fdbbbfe9a276560d5f82e8360ab1910e623bf","source":"security-advisories@github.com"},{"url":"https://github.com/horilla/horilla-hr/security/advisories/GHSA-c38j-fg3w-7rph","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-63432","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T22:17:14.320","lastModified":"2026-09-28T16:32:23.463","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object in the Django template context. An authenticated user with a valid CSRF token can use template attribute traversal to read request.user.password, request.META, and related-user attributes, exposing password hashes, personal data, and server request metadata. Django template restrictions prevent arbitrary code execution through this primitive, so the demonstrated impact is information disclosure and possible offline password cracking or account compromise. This issue is fixed in versions 1.6.0 and 2.0.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"horilla","product":"horilla-hr","versions":[{"version":">= 1.0.0, < 1.6.0","status":"affected"},{"version":">= 2.0.0-beta.1, < 2.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:32:38.553597Z","id":"CVE-2026-63432","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/horilla/horilla-hr/commit/bd3eed2168b0167f273a8dd7f218f1b37320ac39","source":"security-advisories@github.com"},{"url":"https://github.com/horilla/horilla-hr/commit/f1ca7cbc6216cb5bf19fc0174f49994ce5ffc2ad","source":"security-advisories@github.com"},{"url":"https://github.com/horilla/horilla-hr/releases/tag/2.0.0","source":"security-advisories@github.com"},{"url":"https://github.com/horilla/horilla-hr/security/advisories/GHSA-9p83-4w63-7c24","source":"security-advisories@github.com"},{"url":"https://github.com/horilla/horilla-hr/security/advisories/GHSA-9p83-4w63-7c24","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-71483","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T22:18:20.173","lastModified":"2026-09-29T18:17:16.577","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_nav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an authenticated employee or administrator reaches the employee filter, allowing access to browser-visible session data and actions with the victim's application privileges. This issue is fixed in version 1.6.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"horilla","product":"horilla-hr","versions":[{"version":"< 1.6.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:41:09.289866Z","id":"CVE-2026-71483","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/horilla/horilla-hr/commit/39ed01306341a1f6b7702df2825ab5431b5401a9","source":"security-advisories@github.com"},{"url":"https://github.com/horilla/horilla-hr/security/advisories/GHSA-rw86-x8hq-xgwh","source":"security-advisories@github.com"},{"url":"https://github.com/horilla/horilla-hr/security/advisories/GHSA-rw86-x8hq-xgwh","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-7799","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:18:38.263","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-7800","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:18:38.327","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-88003","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T22:18:49.580","lastModified":"2026-09-28T15:07:51.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because Admin_Controller trusts the user_type snapshot stored in an existing session instead of revalidating ip_users.user_type. When one administrator downgrades another account, the target's active session continues to authorize administrative requests. The downgraded user can use Users::form() to set user_type back to 1, restoring the database role and making the privilege escalation persistent. This vulnerability is fixed in 1.7.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"InvoicePlane","product":"InvoicePlane","versions":[{"version":"< 1.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T13:04:11.170771Z","id":"CVE-2026-88003","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/904847f4e87b66fd6743cf9cc6f88b66c7fc3b81","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/daa49ce3a50e0c93e01459b69c0d61bfc23d23eb","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-25xj-pj36-wpp8","source":"security-advisories@github.com"},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-25xj-pj36-wpp8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-91768","sourceIdentifier":"security@php.net","published":"2026-09-25T22:18:49.807","lastModified":"2026-09-29T21:27:41.130","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."}],"affected":[{"source":"security@php.net","affectedData":[{"vendor":"PHP Group","product":"PHP","defaultStatus":"unaffected","packageName":"PHP-FPM","versions":[{"version":"8.2.*","lessThan":"8.2.34","versionType":"semver","status":"affected"},{"version":"8.3.*","lessThan":"8.3.35","versionType":"semver","status":"affected"},{"version":"8.4.*","lessThan":"8.4.26","versionType":"semver","status":"affected"},{"version":"8.5.*","lessThan":"8.5.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@php.net","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T12:57:04.931780Z","id":"CVE-2026-91768","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@php.net","type":"Secondary","description":[{"lang":"en","value":"CWE-1023"}]}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637","source":"security@php.net"}]}},{"cve":{"id":"CVE-2026-92842","sourceIdentifier":"security@php.net","published":"2026-09-25T22:18:49.943","lastModified":"2026-09-29T21:27:41.130","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}],"affected":[{"source":"security@php.net","affectedData":[{"vendor":"PHP Group","product":"PHP","defaultStatus":"unaffected","packageName":"ext-standard","versions":[{"version":"8.2.*","lessThan":"8.2.34","versionType":"semver","status":"affected"},{"version":"8.3.*","lessThan":"8.3.35","versionType":"semver","status":"affected"},{"version":"8.4.*","lessThan":"8.4.26","versionType":"semver","status":"affected"},{"version":"8.5.*","lessThan":"8.5.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@php.net","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T12:56:55.648676Z","id":"CVE-2026-92842","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@php.net","type":"Secondary","description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6","source":"security@php.net"}]}},{"cve":{"id":"CVE-2026-9652","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:18:50.070","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-9655","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-25T22:18:50.130","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-57449","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T23:16:53.990","lastModified":"2026-09-28T14:17:16.140","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When `ACTUAL_GITHUB_TOKEN` is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API allowlist check uses a raw `startsWith()` prefix test for `/repos/{owner}/{repo}` without requiring a path boundary after the repository name. If an allowlisted public plugin repository is `https://github.com/acme/plugin`, the proxy also accepts GitHub API URLs. Those URLs are outside the allowlisted repository but still pass because their API path starts with `/repos/acme/plugin`. The proxy then forwards the request with the server's `ACTUAL_GITHUB_TOKEN`, allowing any authenticated Actual user to read private GitHub resources reachable by that token. Version 26.7.0 fixes the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"actualbudget","product":"actual","versions":[{"version":"< 26.7.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T13:07:03.977402Z","id":"CVE-2026-57449","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/actualbudget/actual/security/advisories/GHSA-m62c-5q34-f3cf","source":"security-advisories@github.com"},{"url":"https://github.com/actualbudget/actual/security/advisories/GHSA-m62c-5q34-f3cf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-86066","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T23:16:54.167","lastModified":"2026-09-30T01:16:38.087","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ changes attendance_validated, is_validate_request_approved, approved_by, and related pending-request state through an HTTP GET before calling attendance.save(), so Django does not require CSRF validation for the action. An unauthenticated attacker can cause a logged-in manager with attendance.change_attendance to make a top-level request that carries the manager's SameSite=Lax session cookie, silently approving attendance with the victim's privileges and attributing the approval to the victim in the audit trail. This issue is fixed in version 2.0.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"horilla","product":"horilla-hr","versions":[{"version":"< 2.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:14:09.096612Z","id":"CVE-2026-86066","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://github.com/horilla/horilla-hr/commit/87a23ecaf2944c15dc5c131f813d2b83fd56eaa0","source":"security-advisories@github.com"},{"url":"https://github.com/horilla/horilla-hr/releases/tag/2.0.0","source":"security-advisories@github.com"},{"url":"https://github.com/horilla/horilla-hr/security/advisories/GHSA-65vj-5p5g-pv5m","source":"security-advisories@github.com"},{"url":"https://github.com/horilla/horilla-hr/security/advisories/GHSA-65vj-5p5g-pv5m","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96795","sourceIdentifier":"security-advisories@github.com","published":"2026-09-25T23:16:55.020","lastModified":"2026-09-28T16:32:23.463","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes field_tuple[1], interpolates it into dynamic_fn_str as Python source, and passes the generated function definition to exec(). A crafted string that remains valid under ast.literal_eval can inject Python syntax into a default argument evaluated during function definition, allowing arbitrary operating-system commands to execute with the application process privileges, including root privileges in the shipped Docker image. This issue is fixed in version 2.0.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"horilla","product":"horilla-hr","versions":[{"version":"< 2.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T13:48:07.041623Z","id":"CVE-2026-96795","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/horilla/horilla-hr/releases/tag/2.0.0","source":"security-advisories@github.com"},{"url":"https://github.com/horilla/horilla-hr/security/advisories/GHSA-5g4v-4rv4-r26f","source":"security-advisories@github.com"},{"url":"https://github.com/horilla/horilla-hr/security/advisories/GHSA-5g4v-4rv4-r26f","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100503","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T01:16:59.880","lastModified":"2026-10-08T16:43:21.090","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"NationalSecurityAgency","product":"ghidra","defaultStatus":"unaffected","repo":"https://github.com/NationalSecurityAgency/ghidra","packageURL":"pkg:github/nationalsecurityagency/ghidra","versions":[{"version":"0","lessThanOrEqual":"12.1.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:23:50.475506Z","id":"CVE-2026-100503","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*","versionEndIncluding":"12.1.4","matchCriteriaId":"62382A4B-67F0-40E0-A818-33CBC805DCE4"}]}]}],"references":[{"url":"https://github.com/NationalSecurityAgency/ghidra","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/merge.cc#L462-L472","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/subflow.cc#L2717-L2745","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://github.com/NationalSecurityAgency/ghidra/commit/5ef1ee4d7a25a65db195f3a70f681ca74440be61","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://www.vulncheck.com/advisories/ghidra-through-12.1.4-heap-use-after-free-in-decompiler","source":"disclosure@vulncheck.com","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-100504","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T01:17:00.043","lastModified":"2026-10-08T16:30:04.767","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled, corrupting memory and potentially achieving code execution."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"NationalSecurityAgency","product":"ghidra","defaultStatus":"unaffected","repo":"https://github.com/NationalSecurityAgency/ghidra","packageURL":"pkg:github/nationalsecurityagency/ghidra","versions":[{"version":"0","lessThanOrEqual":"12.1.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:40:22.713904Z","id":"CVE-2026-100504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*","versionEndIncluding":"12.1.4","matchCriteriaId":"62382A4B-67F0-40E0-A818-33CBC805DCE4"}]}]}],"references":[{"url":"https://github.com/NationalSecurityAgency/ghidra","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/multiprecision.cc#L29-L61","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/ruleaction.cc#L7848-L7878","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://github.com/NationalSecurityAgency/ghidra/commit/6babe3c1cec7f5ec920dd16cdc86a02893e5b33c","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://www.vulncheck.com/advisories/ghidra-through-12.1.4-stack-based-buffer-overflow-via-leftshift128","source":"disclosure@vulncheck.com","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-100505","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T01:17:00.200","lastModified":"2026-10-08T16:24:25.650","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries containing strings or constant byte stores that end in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"NationalSecurityAgency","product":"ghidra","defaultStatus":"unaffected","repo":"https://github.com/NationalSecurityAgency/ghidra","packageURL":"pkg:github/nationalsecurityagency/ghidra","versions":[{"version":"9.2","lessThanOrEqual":"12.1.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:01:09.982721Z","id":"CVE-2026-100505","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*","versionStartIncluding":"9.2","versionEndIncluding":"12.1.4","matchCriteriaId":"B4A29C6E-DEEC-4890-A0CF-26205DA3D3F2"}]}]}],"references":[{"url":"https://github.com/NationalSecurityAgency/ghidra","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/stringmanage.cc#L324-L410","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://github.com/NationalSecurityAgency/ghidra/commit/e37c57f3d9c29511a1860f0a735df53131d403d7","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://www.vulncheck.com/advisories/ghidra-11.2-through-12.1.4-heap-out-of-bounds-read-via-stringmanager","source":"disclosure@vulncheck.com","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-100520","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T01:17:00.357","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"crivion","product":"Laranode","defaultStatus":"unaffected","programFiles":["app/Actions/Filemanager/UploadFileAction.php","routes/web.php"],"repo":"https://github.com/crivion/laranode","versions":[{"version":"0","lessThan":"1.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:15:24.298150Z","id":"CVE-2026-100520","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/crivion/laranode","source":"disclosure@vulncheck.com"},{"url":"https://github.com/crivion/laranode/blob/v1.2/app/Actions/Filemanager/UploadFileAction.php","source":"disclosure@vulncheck.com"},{"url":"https://github.com/crivion/laranode/commit/5c2b18ae99caf77a6fb6cc5c0ab66562bd673424","source":"disclosure@vulncheck.com"},{"url":"https://github.com/crivion/laranode/pull/21","source":"disclosure@vulncheck.com"},{"url":"https://github.com/crivion/laranode/releases/tag/v1.2.1","source":"disclosure@vulncheck.com"},{"url":"https://github.com/crivion/laranode/security/advisories/GHSA-34h2-2696-vfvr","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/laranode-before-1.2.1-path-traversal-in-file-manager-upload-endpoint","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100521","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T01:17:00.517","lastModified":"2026-09-29T18:17:05.373","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor who opens the link, including administrators."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cotonti","product":"Cotonti","defaultStatus":"unaffected","programFiles":["plugins/search/search.header.php","plugins/search/search.page.first.php"],"repo":"https://github.com/Cotonti/Cotonti","packageURL":"pkg:composer/cotonti/cotonti","versions":[{"version":"0","lessThanOrEqual":"1.0.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:21:30.780299Z","id":"CVE-2026-100521","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/Cotonti/Cotonti","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/search/search.header.php","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/search/search.page.first.php","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/issues/1907","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/pull/1908","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/cotonti-through-1.0.0-reflected-xss-via-search-highlight-parameter","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100522","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T01:17:00.700","lastModified":"2026-09-28T18:17:11.477","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary JavaScript in victim browser sessions."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cotonti","product":"Cotonti","defaultStatus":"unaffected","programFiles":["message.php"],"repo":"https://github.com/Cotonti/Cotonti","packageURL":"pkg:composer/cotonti/cotonti","versions":[{"version":"0","lessThanOrEqual":"1.0.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:41:22.365924Z","id":"CVE-2026-100522","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/Cotonti/Cotonti","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/blob/1.0.0/message.php","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/issues/1907","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/pull/1908","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/cotonti-through-1.0.0-reflected-xss-via-message-php-lng-parameter","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100523","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T01:17:00.870","lastModified":"2026-10-05T15:17:10.117","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing attacks."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cotonti","product":"Cotonti","defaultStatus":"unaffected","programFiles":["message.php","system/common.php"],"repo":"https://github.com/Cotonti/Cotonti","packageURL":"pkg:composer/cotonti/cotonti","versions":[{"version":"0","lessThanOrEqual":"1.0.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:01:31.542603Z","id":"CVE-2026-100523","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://github.com/Cotonti/Cotonti","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/blob/1.0.0/message.php","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/blob/1.0.0/system/common.php","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/issues/1907","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/pull/1908","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/cotonti-through-1.0.0-open-redirect-via-message-php-redirect-parameter","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100524","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T01:17:01.040","lastModified":"2026-09-30T01:16:32.800","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause extensions by tricking them into visiting a malicious page while authenticated."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cotonti","product":"Cotonti","defaultStatus":"unaffected","programFiles":["system/admin/admin.extensions.php"],"repo":"https://github.com/Cotonti/Cotonti","packageURL":"pkg:composer/cotonti/cotonti","versions":[{"version":"0","lessThanOrEqual":"1.0.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:16:21.979659Z","id":"CVE-2026-100524","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://github.com/Cotonti/Cotonti","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.extensions.php","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/issues/1907","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/pull/1908","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-via-extensions-manager","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100525","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:57.563","lastModified":"2026-10-08T16:16:55.783","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) before version 2026.9.3 does not enforce the operator.read scope on its authenticated metrics endpoint. In deployments using an identity-bearing Gateway authentication mode such as trusted-proxy, a caller whose effective role has no read scope can retrieve the diagnostics document even though ordinary read methods reject the same identity, disclosing operational metrics to an authenticated profile intentionally limited below read access. Shared-secret Gateway callers already hold the documented full operator scope and are not affected. The issue is fixed in 2026.9.3; as a workaround, disable the Prometheus endpoint or ensure every identity that can reach it is intended to hold operator.read."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"diagnostics-prometheus","defaultStatus":"unaffected","packageURL":"pkg:npm/%40openclaw/diagnostics-prometheus","versions":[{"version":"0","lessThan":"2026.9.3","versionType":"semver","status":"affected"},{"version":"2026.9.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:17:48.054599Z","id":"CVE-2026-100525","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rx8p-qcpv-c7vr","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-diagnostics-prometheus-before-2026.9.3-authentication-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100526","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:57.750","lastModified":"2026-10-08T16:16:55.933","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw's Discord integration (npm package @openclaw/discord) before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same sender's configured media roots would otherwise reject, placing bytes from an out-of-policy local file into an outbound emoji or sticker upload. Exploitation requires access to the guild asset action and knowledge or derivation of a useful local path; the issue does not permit unrestricted filesystem browsing or code execution. The issue is fixed in @openclaw/discord 2026.9.3."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"discord","defaultStatus":"unaffected","packageURL":"pkg:npm/%40openclaw/discord","versions":[{"version":"0","lessThan":"2026.9.3","versionType":"semver","status":"affected"},{"version":"2026.9.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:39:21.336212Z","id":"CVE-2026-100526","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xvwp-wmh2-fq48","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/vulnerability-in-discord","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100527","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:57.910","lastModified":"2026-10-05T15:17:10.277","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authentication capacity. Attackers can hold every pending slot by maintaining silent WebSocket upgrades, preventing paired extensions from completing Browser Relay Authentication v2."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.2","versionType":"semver","status":"affected"},{"version":"2026.8.2","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:02:42.599482Z","id":"CVE-2026-100527","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-m78m-7h3q-q938","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.2-denial-of-service-via-browser-relay","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100528","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:58.057","lastModified":"2026-09-30T01:16:32.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a model configuration hot reload retains that provider's credential while the OpenAI SDK selects its own default endpoint. A resulting request could disclose the configured third-party provider credential to an unrelated provider endpoint and fail with a misleading authentication error. Operators who observed this condition should rotate the affected credential. The issue is fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:17:00.515162Z","id":"CVE-2026-100528","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vhpg-cq3w-v8p9","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-credential-disclosure-via-provider-endpoint","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100529","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:58.217","lastModified":"2026-09-29T18:17:05.640","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access sibling paths or different nodes beyond the operator's original approval scope."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:16:42.852928Z","id":"CVE-2026-100529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7jfq-rmfm-29wp","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-authorization-scope-widening-via-file-transfer","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100530","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:58.367","lastModified":"2026-09-28T18:17:11.777","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewed files or repositories with materially different effects."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:42:00.366502Z","id":"CVE-2026-100530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3mq7-q27j-mq7q","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-exec-approval-directory-binding","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100531","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:58.513","lastModified":"2026-10-08T16:16:56.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the share metadata used to prove it belongs to the requested conversation, the conversation-authorization check fails open. An authenticated caller restricted to a single conversation who knows or obtains a file identifier can therefore download file contents from outside that conversation's scope, disclosing data across configured conversation boundaries. The issue does not allow listing arbitrary Slack files and does not bypass Slack authentication itself. The issue is fixed in version 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"slack","defaultStatus":"unaffected","packageURL":"pkg:npm/%40openclaw/slack","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:04:02.250719Z","id":"CVE-2026-100531","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v7hh-7676-rg67","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-slack-before-2026.8.1-authorization-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100532","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:58.660","lastModified":"2026-10-08T16:16:56.217","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"@openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login and receive a new QR code for a configured account, disconnecting the Gateway's WhatsApp account and causing loss of availability; full account relinking additionally requires the attacker to scan the returned QR code with another phone. The issue affects the owner-only tool boundary rather than WhatsApp transport authentication. Fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"whatsapp","defaultStatus":"unaffected","packageURL":"pkg:npm/%40openclaw/whatsapp","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:17:51.714600Z","id":"CVE-2026-100532","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9m4p-cqp4-jppq","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-whatsapp-before-2026.8.1-authentication-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100533","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:58.813","lastModified":"2026-09-29T18:17:05.773","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated parent directory components. Admitted requesters can exploit canonically equivalent sibling directories to read files outside the configured workspace boundary."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:14:51.835848Z","id":"CVE-2026-100533","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5rx7-34fw-64qg","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-path-traversal-via-unicode-fallback","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100534","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:58.957","lastModified":"2026-09-28T18:17:11.923","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's configured authority."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:42:54.296816Z","id":"CVE-2026-100534","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g24w-m94m-59qc","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-session-cancellation-authorization-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100535","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:59.103","lastModified":"2026-10-05T15:17:10.567","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-derived text is persisted to session memory. In deployments where session-memory capture and dreaming are enabled, a restricted external sender whose messages are admitted with limited tools can persist instructions that are later supplied to an unattended background (dreaming) agent holding broader file and command capabilities, allowing actions beyond the authority of the original turn and affecting files, commands, or services available to that agent. Exploitation requires the content to be captured, selected for later processing, and followed by the model. The issue is fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.4.5","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:03:06.179071Z","id":"CVE-2026-100535","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-62qm-6fjj-6g23","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-privilege-escalation-via-session-memory","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100536","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:59.247","lastModified":"2026-09-30T01:16:33.267","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to hide unvalidated host paths behind allowed attachment sources. Attackers can exploit this by providing multiple source fields to bypass sandbox path validation and cause Telegram delivery to read and send known host files that would otherwise be rejected."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:18:34.206574Z","id":"CVE-2026-100536","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fphf-69cp-h5xw","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-path-traversal-via-structured-attachments","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100537","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:59.390","lastModified":"2026-09-29T18:17:05.903","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments that use Active Memory together with requester-specific tool rules, deterministic and hidden recall paths can retrieve durable memory and inject it into the agent's context even when toolsBySender explicitly denies that requester access to the memory tools (memory_search, memory_get). As a result, an admitted but denied sender can receive information derived from durable memory in the agent's response without directly invoking any memory tool. The issue is fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:13:50.672983Z","id":"CVE-2026-100537","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wjfv-5qch-m5vj","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-authentication-bypass-via-active-memory","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100538","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:59.537","lastModified":"2026-09-28T18:17:12.070","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling outbound attachments. A sender that has been explicitly denied filesystem read tools can still cause a known local file to be read and returned via a final-response media directive or a message attachment, disclosing local file contents to an admitted requester whose agent turn did not include the read tool. Exploitation requires knowledge or derivation of a useful host path and a delivery flow that accepts local attachments. The issue is fixed in version 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:44:41.492793Z","id":"CVE-2026-100538","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w5x7-c87m-3jpc","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-local-file-read-via-outbound-attachments","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100539","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:59.680","lastModified":"2026-10-05T15:17:10.713","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memory_search and memory_get tool instances retain the enabled configuration captured at creation time because the execution-time resolver treats explicit disablement like an unavailable configuration snapshot and restores the stale authority. As a result, during an already-running agent turn the model can continue searching and reading durable memory after the operator revoked that access, for the remainder of that run. Exploitation requires memory to be disabled while a previously created memory tool remains active. The issue is fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","baseScore":2.6,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:03:52.018927Z","id":"CVE-2026-100539","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-chr6-w4m5-57fv","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-memory-access-control-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100540","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:59.833","lastModified":"2026-10-08T16:16:56.360","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked identity."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"feishu","defaultStatus":"unaffected","packageURL":"pkg:npm/%40openclaw/feishu","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:19:40.343560Z","id":"CVE-2026-100540","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h2qg-fxpv-82v6","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-feishu-before-2026.8.1-authentication-bypass-via-disabled-account","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100541","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:16:59.987","lastModified":"2026-10-08T16:16:56.493","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw's Matrix integration (npm package @openclaw/matrix) versions >= 2026.2.2 and < 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identity. As a result, distinct authenticated Matrix accounts can normalize to the same authorization identity. A Matrix participant controlling a colliding account identifier (a protocol-valid identifier that differs from the configured one only by characters OpenClaw case/Unicode folds; display-name matching is not required) can inherit allowlist, owner-command, exec-approval, or plugin-approval authority configured for another account. The issue is fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"matrix","defaultStatus":"unaffected","packageURL":"pkg:npm/%40openclaw/matrix","versions":[{"version":"2026.2.2","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:33:31.392368Z","id":"CVE-2026-100541","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-178"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hgv5-f2r3-6v9r","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-matrix-before-2026.8.1-authorization-bypass-via-case-folding","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100542","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:00.140","lastModified":"2026-09-28T18:17:12.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained listings so that entry-count and size checks pass, and the archive is then extracted in full. If an operator approves installation of such a malicious or compromised skill archive, over-limit files or entry counts are persisted in the skill tools directory, consuming disk space or inodes. The issue bypasses OpenClaw's extraction budgets but does not by itself execute archive contents. Fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.5.28","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:45:37.027411Z","id":"CVE-2026-100542","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6xpv-wwr5-265h","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-extraction-limit-bypass-via-tar-bz2","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100543","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:00.287","lastModified":"2026-10-05T15:17:10.857","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were reconstructable, these hashes acted as offline password verifiers: a caller able to obtain the redacted configuration (for example via config.get) could test password candidates offline without going through the rate-limited Gateway authentication path. Recovering the password could grant the documented shared-secret operator authority. Secret references were not affected in the same way. The issue is fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:03:22.886551Z","id":"CVE-2026-100543","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qgj5-6x35-9g6f","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-information-disclosure-via-configuration-hash","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100544","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:00.440","lastModified":"2026-10-08T16:16:56.630","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the agent's normal tool authority to a remote caller. A caller who is admitted by the configured inbound-call policy (open, pairing, or allowlist) on a deployment with inbound calling enabled can therefore drive tools intended for the trusted owner, potentially reading data, modifying files, executing commands, or controlling connected services depending on the agent's configuration. The issue is fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"voice-call","defaultStatus":"unaffected","packageURL":"pkg:npm/%40openclaw/voice-call","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:20:26.951466Z","id":"CVE-2026-100544","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rrxp-5mx8-mvhh","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-voice-call-before-2026.8.1-authorization-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100545","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:00.590","lastModified":"2026-09-29T17:17:02.113","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory filename generation was enabled for an agent reachable by lower-trust senders, model-mediated instructions could cause the helper to invoke tools outside that sender's effective policy; the demonstrated impact was the creation of persistent scheduled work. Exploitability depends on the model acting on the injected instruction and on which tools the helper exposes. The issue is fixed in 2026.8.1; as a workaround, disable session-memory filename generation for agents reachable by lower-trust senders."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:11:44.948890Z","id":"CVE-2026-100545","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5fwv-rrvp-8xvr","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-policy-bypass-via-session-filename-generation","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100546","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:00.737","lastModified":"2026-09-28T18:17:12.367","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package `openclaw`) versions >= 2026.7.2 and < 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after an asynchronous control check, causing a transcript to inherit another speaker's owner status. In Discord agent-proxy voice sessions using the affected realtime control path, an utterance from a non-owner participant could reach the downstream agent boundary marked as owner, so owner-sensitive behavior is applied to the wrong speaker. Exploitation depends on concurrent transcript timing and on the tools and commands available to the affected agent. The issue is fixed in 2026.9.2; as a workaround, disable Discord realtime voice for agents that distinguish owner and non-owner senders."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.7.2","lessThan":"2026.9.2","versionType":"semver","status":"affected"},{"version":"2026.9.2","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:46:24.307971Z","id":"CVE-2026-100546","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5x6q-wg56-rxg8","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-2026.7.2-before-2026.9.2-authentication-bypass-via-voice-transcript","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100547","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:00.890","lastModified":"2026-10-05T15:17:10.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw is a coding agent distributed as the npm package `openclaw`. In affected versions (2026.7.1 through 2026.7.2), alternate but valid `file:` URL spellings supplied over the Agent Client Protocol (ACP) were treated as relative paths and were incorrectly classified as reads scoped to the session working directory. When an operator connected `openclaw acp client` to an untrusted or compromised ACP peer, that peer could request a read of a file outside the session working directory without the approval prompt normally required for that path, resulting in disclosure of local file contents. The demonstrated impact is limited to file confidentiality; mutating and command-capable tool classes are not affected. This issue is fixed in OpenClaw 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.7.1-2","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:03:41.533011Z","id":"CVE-2026-100547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-180"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-356g-m7rx-7pm3","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-authentication-bypass-via-file-url","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100548","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:01.040","lastModified":"2026-09-30T01:16:33.823","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is configured and the primary embedding provider fails, the request can be sent to a different fallback provider while still reusing the primary provider's configured API key, causing that credential to be transmitted as a bearer token to an unintended vendor. The practical impact depends on the configured providers, whether failover occurs, and the privileges attached to the primary provider key. The issue is fixed in 2026.8.1; as a workaround, disable cross-provider embedding fallback or configure each provider with separate, narrowly scoped credentials."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.3.28","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:22:00.908573Z","id":"CVE-2026-100548","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-66hm-hxq3-5pfh","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-credential-exposure-via-embedding-fallback","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100549","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:01.187","lastModified":"2026-09-29T17:17:02.247","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply crafted voice attachments that write files outside the intended staging directory to other process-writable locations."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:10:42.739580Z","id":"CVE-2026-100549","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rm45-4jx5-2927","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-path-traversal-via-qqbot-voice-filenames","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100550","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:01.333","lastModified":"2026-09-28T18:17:12.513","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admission check, so a Teams member who is not on the allowlist can still trigger the configured agent despite the administrator's group boundary. The impact depends on the conversations, tools, and data available to that agent. The issue is fixed in version 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:33:40.698433Z","id":"CVE-2026-100550","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8938-r7c6-54vq","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-authentication-bypass-via-access-group","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100551","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:01.487","lastModified":"2026-10-05T15:17:11.143","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an attacker able to redirect the same host and port and present a different certificate that is accepted by iOS system trust can serve a replacement Control UI page; opening the Terminal or a session Dashboard then allows that page to read the injected Gateway token or password. The stolen credential can grant operator access, including reading sensitive Gateway state and invoking host-capable tools. This issue is fixed in 2026.8.11."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","versions":[{"version":"2026.7.1","lessThan":"2026.8.11","versionType":"semver","status":"affected"},{"version":"2026.8.11","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:04:17.659802Z","id":"CVE-2026-100551","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jjpc-p3xf-8g7p","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-ios-control-ui-tls-pin-enforcement-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100552","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:01.640","lastModified":"2026-09-30T01:16:34.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, and patch tools owned by the Codex runtime. When a lower-trust conversation was assigned to a Codex runtime and restricted with a per-chat tool allowlist, a participant able to trigger that agent could still reach native command and file tools, bypassing the configured allowlist. The practical impact depends on the runtime's host permissions and sandbox configuration. The issue is fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:22:34.515129Z","id":"CVE-2026-100552","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wwcw-jfpp-gpxw","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-policy-bypass-via-native-tools","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100553","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:01.790","lastModified":"2026-09-29T17:17:02.370","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted (authenticated) sender can remove a pin from another Feishu group that the sender and the configured account are otherwise permitted to access, bypassing the intended cross-context message mutation policy. Feishu membership and group authorization still apply, and the demonstrated impact is limited to message mutation (pin removal). The issue is fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.6.9","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:09:47.857552Z","id":"CVE-2026-100553","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h9jh-75j7-7hhx","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-2026.6.9-before-2026.8.1-cross-context-policy-bypass-via-feishu-unpin","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100554","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:01.933","lastModified":"2026-09-28T18:17:12.657","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability until WebSocket close cleanup completes. As a result, a revoked paired node can continue exercising its Canvas capability against the capability's configured routes during the close grace period. The issue is fixed in 2026.8.1; as a workaround, restart the Gateway after revoking a node that has Canvas access."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.5.12","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:38:32.165169Z","id":"CVE-2026-100554","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g697-vv6h-r8hv","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-canvas-capability-revocation-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100555","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:02.087","lastModified":"2026-10-05T15:17:11.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to a different destination. When attachment delivery accepted a remotely influenced hostname, an attacker could use DNS rebinding to make the NAS fetch a private or otherwise policy-denied resource and return its contents to the addressed conversation (server-side request forgery). Practical impact depends on NAS routing, resolver behavior, and the response available at the private destination. The issue is fixed in 2026.8.1; as a workaround, disable remote URL attachment forwarding in Synology Chat."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.7.1","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:04:24.718338Z","id":"CVE-2026-100555","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cf95-m4jv-59rc","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-dns-rebinding-via-attachment-delivery","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100556","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:02.237","lastModified":"2026-09-30T01:16:34.223","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package openclaw) versions >= 2026.5.2 and < 2026.8.1 contain an incorrect authorization vulnerability in WhatsApp group handling. A group sender who is admitted for ordinary messages but denied by commands.allowFrom or owner command authorization can issue the /new <model> command to reset the shared group session and persist a provider and model override. This allows a command-denied group member to select a provider and model already permitted by the operator for subsequent turns in the shared group session, potentially changing provider routing, cost, data flow, or availability. It does not allow adding a new provider or host command execution. The issue is fixed in version 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.5.2","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:23:05.228024Z","id":"CVE-2026-100556","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mm7m-wcgh-8mfq","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-authentication-bypass-via-session-reset","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100557","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:02.387","lastModified":"2026-09-29T17:17:02.497","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status. Non-owner senders authorized to invoke skill commands can access owner-only tools and server credentials reserved for owners."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:08:42.857824Z","id":"CVE-2026-100557","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7cp7-87pj-p32v","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-authorization-bypass-via-skill-tool-dispatch","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100558","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:02.533","lastModified":"2026-09-28T18:17:12.803","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade requests to exhaust listener resources and cause denial of service without consuming the WebSocket pre-auth connection budget."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:37:57.490725Z","id":"CVE-2026-100558","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4r25-35qc-fr6j","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-resource-exhaustion-via-websocket-upgrade","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100559","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:02.680","lastModified":"2026-10-05T15:17:11.420","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected authorization prompts."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:04:51.398307Z","id":"CVE-2026-100559","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9f86-pvv5-rxfw","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-command-injection-via-escaped-newlines","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100560","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:02.833","lastModified":"2026-09-30T01:16:34.410","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval prompts, potentially accessing files or internal services."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:23:44.388854Z","id":"CVE-2026-100560","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-74gc-hg2m-79p9","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-reusable-exec-approvals-authorization-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100561","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:02.987","lastModified":"2026-09-29T17:17:02.617","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign wrapper invocation, a later agent turn could substitute an arbitrary inner command and execute it with the OpenClaw process's host privileges without a further approval prompt. Exploitation requires the relevant wrapper to resolve on the host and a prior operator decision allowing that wrapper. Transparent shell carriers and opaque utilities such as process monitors, tracers, namespace tools, and proxy wrappers were affected through related trust-resolution gaps. Fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.3.22","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:07:35.222354Z","id":"CVE-2026-100561","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-ghpx-6xwq-2w4w","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-authentication-bypass-via-exec-wrapper","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100562","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:03.140","lastModified":"2026-09-28T18:17:12.947","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session configurations reserved for operator.admin scope. Attackers with write-scoped credentials can change existing session model, provider, thinking level, and auth-profile settings to redirect traffic and bypass administrative access controls."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:37:10.254946Z","id":"CVE-2026-100562","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j4mm-p864-vx7f","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-authorization-bypass-via-sessions-create","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100563","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:03.290","lastModified":"2026-10-05T15:17:11.557","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or the first user message can place a formula-like cell in the Usage export; if an operator opens that export in a spreadsheet application with formula evaluation enabled, the cell may be evaluated with the permissions of the spreadsheet user. OpenClaw itself does not evaluate the formula, and practical impact depends on the spreadsheet application's security settings. The issue is fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:05:09.594260Z","id":"CVE-2026-100563","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1236"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xx9p-hc9w-6p5h","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-csv-formula-injection-via-session-labels","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100564","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:03.447","lastModified":"2026-09-30T01:16:34.573","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:24:23.646268Z","id":"CVE-2026-100564","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1236"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-39hf-qg99-f4qv","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-csv-formula-injection-via-attendance-export","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100566","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:03.593","lastModified":"2026-10-08T16:16:56.770","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restrictions when DM access is broader than intended group access."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"line","defaultStatus":"unaffected","packageURL":"pkg:npm/%40openclaw/line","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T17:05:29.994494Z","id":"CVE-2026-100566","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fgwg-c3wv-8f45","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-line-before-2026.8.1-access-control-inheritance","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100567","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:03.737","lastModified":"2026-09-28T18:17:13.090","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions >= 2026.4.5 and < 2026.8.1, the Gateway validated a single DNS resolution result for a configured remote Chrome DevTools Protocol (CDP) hostname, but the raw WebSocket and Playwright transports performed a later, independent DNS resolution, discarding the DNS pinning enforced at validation time. An attacker who controls an approved CDP hostname or its DNS answers can exploit this check-then-use gap via DNS rebinding to make the Gateway connect to a loopback, private, link-local, cloud metadata, or other SSRF-policy-denied address. The impact depends on the remote CDP configuration, DNS timing, and the services reachable from the Gateway host. The issue is fixed in 2026.8.1; as a mitigation, disable hostname-based remote CDP endpoints or restrict them to trusted, stable infrastructure."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.4.5","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.9,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:36:37.711447Z","id":"CVE-2026-100567","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p3h6-v2h4-36q2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-dns-rebinding-via-cdp-hostname","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100568","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:03.887","lastModified":"2026-10-05T15:17:11.703","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless command jobs. Attackers can inspect stored environment variables and force-run disabled or unscheduled command jobs to access secrets and execute operator-authored commands."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:06:29.181481Z","id":"CVE-2026-100568","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hpg5-cq3m-phqp","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-unauthorized-command-job-access","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100569","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:04.030","lastModified":"2026-09-30T01:16:34.730","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw is an npm-distributed application. In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block variables ending in `_ENDPOINT`, so an untrusted workspace `.env` file could set AZURE_SPEECH_ENDPOINT. Azure Speech preferred that value over the configured region, so when a synthesis or voice-list request was made, the attacker-selected endpoint received the operator's Azure Speech key in the request header, allowing the key to be reused against the operator's Azure Speech resource. Exploitation requires an operator to start OpenClaw in attacker-controlled workspace content with Azure Speech configured with a key and region and no trusted endpoint override set. The issue is fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.4.25","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:25:41.866412Z","id":"CVE-2026-100569","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-522"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-pfrw-r5vr-89hw","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-credential-exposure-via-endpoint-override","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100570","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:04.177","lastModified":"2026-09-29T17:17:02.883","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDK_PYTHON_ARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when gcloud is launched, and the gcloud launcher passes it as arguments to the trusted Python interpreter. A crafted CLOUDSDK_PYTHON_ARGS value can therefore cause Python to execute attacker-supplied code with the OpenClaw host user's permissions, allowing credentials to be read, files to be modified, or other processes to be started. This issue is fixed in version 2026.8.1; as a workaround, run Gmail setup only from trusted workspaces and clear inherited CLOUDSDK_* variables beforehand."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.3.28","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T16:57:03.712469Z","id":"CVE-2026-100570","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5mrc-77hj-xjxv","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-remote-code-execution-via-cloudsdk-python-args","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100571","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:04.330","lastModified":"2026-09-28T18:17:13.233","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunnel so that multiple external clients share one socket address, an unauthenticated remote sender can exhaust the shared pre-authentication rate-limit budget with invalid requests, causing subsequent correctly signed Twilio callbacks to receive HTTP 429 responses. The result is temporary inbound SMS loss while the shared window remains exhausted; the attacker cannot forge a callback or access message data. Fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.6.6","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:34:23.543339Z","id":"CVE-2026-100571","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xw48-j584-r73h","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-sms-webhook-rate-limit-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100572","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:04.570","lastModified":"2026-10-05T15:17:13.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions >= 2026.3.25 and < 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single socket address, an unauthenticated sender can exhaust the shared invalid-token budget, causing subsequent legitimate Synology Chat webhook callbacks to be rejected until the rate-limit window expires. The attacker cannot obtain a valid token or read message data; the impact is temporary loss of channel availability. Fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.3.25","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:07:19.644447Z","id":"CVE-2026-100572","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fw6q-2frm-jxxr","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-denial-of-service-via-rate-limit","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100573","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:04.743","lastModified":"2026-09-30T01:16:34.900","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions the operator intended to exclude from the sandbox."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:26:23.449258Z","id":"CVE-2026-100573","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5m4g-88rg-69pj","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-sandbox-policy-bypass-via-mcp-loopback","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100574","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:04.887","lastModified":"2026-09-29T17:17:03.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-side request forgery vulnerability in its trusted-host DNS checks. For fetches that use the trusted-host DNS recheck, a trusted hostname that resolves to an unspecified address (0.0.0.0 or ::) bypasses the SSRF destination validation. An attacker who can influence DNS for an allowed hostname can therefore cause a guarded fetch to reach a service bound only to loopback and disclose its response; the practical impact depends on the reachable service and the data it returns. Fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T16:51:05.390501Z","id":"CVE-2026-100574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-72p2-79fg-pvph","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-ssrf-via-trusted-host-dns","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100575","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:05.030","lastModified":"2026-10-08T16:16:56.943","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"slack","defaultStatus":"unaffected","packageURL":"pkg:npm/%40openclaw/slack","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:28:15.956137Z","id":"CVE-2026-100575","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-58qx-6m8p-wh2j","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-slack-before-2026.8.1-authentication-bypass-via-group-dm","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100576","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:05.187","lastModified":"2026-10-05T15:17:13.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reaching blocked destinations. Attackers can use the wait --fn function against an existing browser session to request loopback or private destinations without navigation checks applied to other browser actions."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:07:33.940430Z","id":"CVE-2026-100576","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4g58-43jr-6738","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-ssrf-via-browser-wait-predicates","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100577","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:05.333","lastModified":"2026-09-30T01:16:35.063","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the OpenClaw host."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:27:00.221567Z","id":"CVE-2026-100577","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fvxr-9g24-x3hf","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-server-side-request-forgery-via-video-asset","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100578","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:05.483","lastModified":"2026-09-28T20:17:07.223","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn whose tool inventory includes the `gateway` and `cron` tools, causing the agent to invoke owner-only configuration or scheduling operations, including persistent state changes. Practical impact depends on the tools selected by the model and the caller's ability to steer the turn. Shared-secret token and password callers are treated as fully trusted operators under OpenClaw's security model and are outside the scope of this issue. The issue is fixed in 2026.7.1; as a workaround, restrict chat.send to administrators in identity-bearing deployments and remove `gateway` and `cron` from affected agent tool policies."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T19:32:56.856353Z","id":"CVE-2026-100578","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qw7m-h363-33qw","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authorization-bypass-via-chat-send","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100579","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:05.633","lastModified":"2026-09-28T18:17:13.520","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments (authentication modes that honor caller identity and narrower operator scopes), a write-scoped caller can supply another sender's identifier to the channel authorization checks and invoke a channel action under that spoofed requester identity, reaching operations the channel adapter would have denied to the real caller. Practical impact depends on the enabled channel, the action, and the target account's permissions. Shared-secret token and password callers are full trusted operators under OpenClaw's security model and are out of scope. The issue is fixed in 2026.7.1; as a workaround, restrict message.action to administrators and disable sensitive channel actions that rely on requester identity."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:31:27.703171Z","id":"CVE-2026-100579","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4wvr-f35r-f8w4","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authentication-bypass-via-spoofed-requester","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100580","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:05.783","lastModified":"2026-10-05T15:17:13.500","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a persistent cron job that executes attacker-selected commands with the privileges of the OpenClaw process user, resulting in access to host files and credentials and impact to scheduled service availability. The issue is limited to cron jobs created or edited through the model-facing cron tool; direct CLI and authorized Gateway scheduling surfaces are trusted operator controls. Fixed in 2026.7.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:07:53.601224Z","id":"CVE-2026-100580","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-178"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8xxh-v4vc-qvm4","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-remote-code-execution-via-cron-tool","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100581","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:05.930","lastModified":"2026-09-30T01:16:35.240","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencrypted device backups or extracted App Group containers can recover valid Gateway tokens and passwords to authenticate with operator authority."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.8.11","versionType":"semver","status":"affected"},{"version":"2026.8.11","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:27:35.574477Z","id":"CVE-2026-100581","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-312"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gcm4-fmcp-2f9r","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-ios-before-2026.8.11-credential-storage-via-share-extension","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100582","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:06.080","lastModified":"2026-10-08T16:16:57.110","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-trust sender or a steered agent with access to a channel read action can therefore retrieve content or metadata from channels or rooms excluded by the operator's read policy; the practical impact depends on the permissions held by the connected bot account. The issue is fixed in 2026.8.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"msteams","defaultStatus":"unaffected","packageURL":"pkg:npm/%40openclaw/msteams","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]},{"vendor":"openclaw","product":"feishu","defaultStatus":"unaffected","packageURL":"pkg:npm/%40openclaw/feishu","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]},{"vendor":"openclaw","product":"matrix","defaultStatus":"unaffected","packageURL":"pkg:npm/%40openclaw/matrix","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]},{"vendor":"openclaw","product":"googlechat","defaultStatus":"unaffected","packageURL":"pkg:npm/%40openclaw/googlechat","versions":[{"version":"0","lessThan":"2026.8.1","versionType":"semver","status":"affected"},{"version":"2026.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T19:31:40.726490Z","id":"CVE-2026-100582","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g7fw-3gjp-g5hf","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-msteams-before-2026.8.1-channel-read-allowlist-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100583","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:06.223","lastModified":"2026-10-08T16:16:57.263","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust senders to retrieve information excluded by channel allowlists. Attackers can bypass the configured Discord read-target policy to access guild metadata from servers or channels outside the operator's allowlist."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"discord","defaultStatus":"unaffected","packageURL":"pkg:npm/%40openclaw/discord","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:30:49.788230Z","id":"CVE-2026-100583","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-35wj-hm2r-ghgw","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-discord-before-2026.7.1-authorization-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100584","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:06.373","lastModified":"2026-10-05T15:17:13.660","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named executable located in the workspace directory. If lower-trust content can place an executable with an approved basename into an agent-writable workspace and steer an approved PowerShell command that uses a bare executable name, OpenClaw may run the workspace file instead of the allowlisted path, executing arbitrary code with the privileges of the Gateway or node-host user. The issue does not require replacement of the approved executable itself. Version 2026.7.1 contains a fix; as a workaround, avoid bare executable names in approved PowerShell commands and keep executable files out of agent-writable workspaces."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.2.26","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:08:13.762658Z","id":"CVE-2026-100584","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-426"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rgjw-6v73-php6","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-allowlist-bypass-via-workspace-shadows","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100585","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:06.517","lastModified":"2026-09-30T01:16:35.393","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request intended for the owner, causing the requested action to proceed without owner consent. The practical impact depends on the pending action and the host capabilities requested by the Claude Code run. The issue is fixed in version 2026.7.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:28:32.638432Z","id":"CVE-2026-100585","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p5g8-m35v-7m82","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authentication-bypass-via-mcp-channel","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100586","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:06.660","lastModified":"2026-09-28T20:17:07.507","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization when creating native conversation bindings. Non-owner channel senders with command access can create bindings to the native Codex runtime and execute host-capable turns with access to files, tools, and processes."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T19:28:46.450464Z","id":"CVE-2026-100586","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9p6m-2872-xm7x","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-codex-before-2026.7.1-authorization-bypass-via-bind","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100587","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:06.810","lastModified":"2026-09-28T18:17:13.803","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host confidentiality, integrity, and availability."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:30:05.458252Z","id":"CVE-2026-100587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-pjjr-5qhr-5w6r","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authorization-bypass-via-codex-install","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100588","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:06.963","lastModified":"2026-10-05T15:17:13.850","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') before 2026.7.1 does not enforce the administrator scope requirement on browser control when it is reached through the node.invoke method, although direct browser.request access requires administrator scope. In Gateway deployments that honor caller identity and narrower operator scopes, a write-scoped caller with access to a connected browser-capable node can inspect pages, navigate tabs, or interact with browser-visible applications without the configured admin requirement; practical impact depends on the browser profile and signed-in state. Shared-secret token and password callers are considered fully trusted operators under OpenClaw's security model and are not affected. The issue is fixed in 2026.7.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:08:37.392976Z","id":"CVE-2026-100588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jghr-xp78-995p","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authentication-bypass-via-node-invoke","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100589","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:07.110","lastModified":"2026-09-30T01:16:35.547","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired node browser actions despite allowHostControl=false configuration. Attackers with control over sandboxed agent input can select a paired node and perform host browser operations, inspecting or manipulating the connected browser profile and its authenticated state."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:29:06.622440Z","id":"CVE-2026-100589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9x88-f7rh-4c83","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-sandbox-bypass-via-browser-node","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100590","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:07.257","lastModified":"2026-09-28T20:17:07.640","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.7.1 contains an authorization bypass vulnerability in the /voice set command that allows non-owner external-channel senders to persist Gateway voice configuration. Attackers with command access can change the voice used by Talk responses for the configured provider, affecting configuration integrity without exposing credentials or granting additional host capabilities."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T19:21:39.857409Z","id":"CVE-2026-100590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5j27-v2pw-cj9m","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authorization-bypass-via-voice-set","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100591","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:07.403","lastModified":"2026-09-28T18:17:13.947","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for future sessions or re-enabling global recall where the owner expected it to remain disabled. The issue is limited to persistent global on/off mutations; session-level controls and read-only status remain governed by existing command policy. The issue is fixed in version 2026.7.1. (Suggested title: \"OpenClaw before 2026.7.1 missing owner authorization check on Active Memory global toggles\".)"}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:29:24.088872Z","id":"CVE-2026-100591","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xw9g-7xvv-gcjc","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authentication-bypass-via-active-memory","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100592","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:07.553","lastModified":"2026-10-05T15:17:13.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw is an agent gateway distributed via npm. In versions >= 2026.4.10 and < 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dreaming off' commands to enable or disable the Gateway's Memory Core dreaming behavior, disabling background memory processing or re-enabling durable memory promotion where the owner expected it to remain disabled; the practical confidentiality, integrity, and availability impact depends on stored conversation material and subsequent memory use. Read-only status and help commands remain governed by normal command policy. The issue is fixed in version 2026.7.1. As a workaround, disable dreaming commands in external channels or restrict channel command access to owners."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.4.10","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:08:50.384597Z","id":"CVE-2026-100592","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-22v4-33m3-8p7m","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authentication-bypass-via-memory-dreaming","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100593","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:07.703","lastModified":"2026-09-30T01:16:35.687","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the documented owner-only requirement for persistent `/activation` policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based activation, causing the agent to respond more broadly in the group (exposing its responses to additional group traffic) or suppressing expected activation behavior until an owner restores the intended setting. The issue is fixed in version 2026.7.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:29:46.825195Z","id":"CVE-2026-100593","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q9j5-4xr6-xqqw","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authentication-bypass-via-activation","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100594","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:07.857","lastModified":"2026-09-28T20:17:07.773","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and receive owner-only trajectory bundles. Attackers can access prompts, model messages, tool schemas, runtime events, and local path metadata from affected sessions by exploiting insufficient authorization checks."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T19:18:36.504048Z","id":"CVE-2026-100594","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-89cw-7452-cfrf","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authorization-bypass-via-trajectory-export","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100595","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:08.037","lastModified":"2026-09-28T18:17:14.090","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the diagnostics export command that allows non-owner channel senders to access owner-only host diagnostic bundles. Attackers can request and receive diagnostic details about the host, configuration, runtime, and connected services intended only for owners."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:28:54.723933Z","id":"CVE-2026-100595","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4hwv-rj92-h7rp","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authorization-bypass-via-diagnostics","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100596","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:08.187","lastModified":"2026-10-05T15:17:14.137","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host confidentiality, integrity, and availability."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:09:00.603080Z","id":"CVE-2026-100596","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wwx7-573h-pqwc","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authorization-bypass-via-mcp-configuration","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100597","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:08.337","lastModified":"2026-09-30T01:16:35.837","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package 'openclaw') before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safety check, if the path is changed concurrently. An attacker able to win the race can cause a sandboxed operation to delete, create, or rename a host path outside the intended mirror root with the permissions of the OpenClaw process user. This does not require an operator to have granted host filesystem access outside the sandbox. The issue is fixed in 2026.7.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:30:25.759138Z","id":"CVE-2026-100597","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-crg9-c62w-j2p5","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-path-traversal-via-filesystem-race","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100598","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:08.487","lastModified":"2026-09-28T20:17:07.933","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval request could instead attach to ordinary outbound text when unrelated outbound messages and a pending approval are present in the same conversation. As a result, an approver's reaction to unrelated text could be interpreted as approving or denying a pending host action; the practical impact depends on the pending request, conversation timing, and the actions available to the OpenClaw process. The issue does not change the authority of correctly identified approvers. This is fixed in version 2026.7.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T19:17:26.583581Z","id":"CVE-2026-100598","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r88x-r7jj-f2cf","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-approval-binding-logic-error","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100599","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T03:17:08.667","lastModified":"2026-09-28T17:17:42.627","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In deployments with the Google Meet plugin enabled, a paired Chrome node, and the googlemeet.chrome node command allowed, a tool-enabled agent able to invoke that command can execute attacker-selected processes on the paired node, impacting files, credentials, browser profiles, and availability on that node. The issue is fixed in 2026.7.1; as a workaround, remove googlemeet.chrome from allowed node commands or disable the Google Meet plugin."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"2026.5.1","lessThan":"2026.7.1","versionType":"semver","status":"affected"},{"version":"2026.7.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:01:05.340158Z","id":"CVE-2026-100599","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-224w-vfr9-h35c","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-2026.5.1-before-2026.7.1-remote-code-execution-via-googlemeet-chrome","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-15273","sourceIdentifier":"security@wordfence.com","published":"2026-09-26T03:17:08.900","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the Activity Log settings page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"Automatic.css","product":"Automatic.css","defaultStatus":"unaffected","versions":[{"version":"4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:43:36.255835Z","id":"CVE-2026-15273","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://automaticcss.com/changelogs/","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/automaticcss-plugin/trunk/classes/Helpers/Logger.php#L187","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/automaticcss-plugin/trunk/classes/Lib/WideEvents/Formatter/JsonFormatter.php#L25","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/automaticcss-plugin/trunk/classes/Plugin.php#L175","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/automaticcss-plugin/trunk/classes/UI/Settings_Page/Activity_Log.php#L90","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07d697c5-1c15-4d3a-8637-cc4fd408f209?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-11871","sourceIdentifier":"contact@wpscan.com","published":"2026-09-26T07:17:00.570","lastModified":"2026-09-29T13:17:50.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Team Members","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"9.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:35:32.690431Z","id":"CVE-2026-11871","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/9ca61aee-c36a-41c5-b4e7-1626c5720362/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-16591","sourceIdentifier":"contact@wpscan.com","published":"2026-09-26T07:17:01.847","lastModified":"2026-09-26T23:16:34.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Directory Kit","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.5.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:34:59.110471Z","id":"CVE-2026-16591","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/7b5600f1-1024-4329-97de-6347420e46c1/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-18143","sourceIdentifier":"security@wordfence.com","published":"2026-09-26T07:17:02.017","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for `move_uploaded_file()`. This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"Addify","product":"Request a Quote for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.9.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:43:49.202450Z","id":"CVE-2026-18143","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://woocommerce.com/products/request-a-quote-plugin-for-woocommerce/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3417ec27-6abf-45c7-945f-6ef456ba1187?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-19708","sourceIdentifier":"contact@wpscan.com","published":"2026-09-26T07:17:02.397","lastModified":"2026-09-28T16:38:58.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"File Manager","defaultStatus":"unaffected","versions":[{"version":"7.2.2","lessThan":"8.0.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:34:50.000301Z","id":"CVE-2026-19708","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/a0cbfd20-7741-44d0-96c4-054a7952f81b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84095","sourceIdentifier":"contact@wpscan.com","published":"2026-09-26T07:17:02.520","lastModified":"2026-09-28T16:38:58.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"wp-review-slider-pro","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.7.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:34:34.346408Z","id":"CVE-2026-84095","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f788d50b-f507-4821-968e-9ea4f5ab71bd/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84096","sourceIdentifier":"contact@wpscan.com","published":"2026-09-26T07:17:02.623","lastModified":"2026-09-28T16:38:58.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with field values that are output without escaping on public pages, leading to Stored Cross-Site Scripting."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"wp-review-slider-pro","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.7.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:34:25.894993Z","id":"CVE-2026-84096","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b30dd50c-6600-4ad6-8195-7b0606b29c9d/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84097","sourceIdentifier":"contact@wpscan.com","published":"2026-09-26T07:17:02.723","lastModified":"2026-09-28T16:38:58.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"wp-review-slider-pro","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.7.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:34:12.542478Z","id":"CVE-2026-84097","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://wpscan.com/vulnerability/6d51f9c7-3140-4261-954b-8fc497587359/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-85081","sourceIdentifier":"contact@wpscan.com","published":"2026-09-26T07:17:02.823","lastModified":"2026-09-28T16:38:58.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The File Manager WordPress plugin before 8.0.5, FileOrganizer  WordPress plugin before 1.2.1, File Manager Pro  WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control.\n\nThe defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it. Updating the bundled library closes it."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"File Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8.0.5","versionType":"semver","status":"affected"}]},{"vendor":"Unknown","product":"FileOrganizer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.2.1","versionType":"semver","status":"affected"}]},{"vendor":"Unknown","product":"File Manager Pro","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:33:20.658461Z","id":"CVE-2026-85081","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/3c5f9c52-e609-45aa-b441-491e15b3f4b8/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-89237","sourceIdentifier":"contact@wpscan.com","published":"2026-09-26T07:17:02.923","lastModified":"2026-09-28T16:38:58.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Bluff Post","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"1.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:35:17.090496Z","id":"CVE-2026-89237","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://wpscan.com/vulnerability/92355b31-995b-4151-a414-51d3430d0fd6/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-92411","sourceIdentifier":"contact@wpscan.com","published":"2026-09-26T07:17:03.023","lastModified":"2026-09-28T16:38:58.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Delicious  WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Delicious","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.10.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:33:12.412214Z","id":"CVE-2026-92411","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f76a4694-8073-41fe-bb49-4073e6e95ac3/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-96524","sourceIdentifier":"contact@wpscan.com","published":"2026-09-26T07:17:03.130","lastModified":"2026-09-28T15:17:09.083","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MCP Server for WordPress  WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MCP Server for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.8.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:32:49.495318Z","id":"CVE-2026-96524","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://wpscan.com/vulnerability/d8e97a77-b70f-41f0-8d1e-0d50b6d878c6/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-96525","sourceIdentifier":"contact@wpscan.com","published":"2026-09-26T07:17:03.233","lastModified":"2026-09-28T15:17:09.083","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MCP Server for WordPress  WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflows created by administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MCP Server for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.8.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:32:39.736251Z","id":"CVE-2026-96525","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f814fb88-4198-4ba0-972c-658a1d672289/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-96526","sourceIdentifier":"contact@wpscan.com","published":"2026-09-26T07:17:03.333","lastModified":"2026-09-28T15:17:09.083","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MCP Server for WordPress  WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users' private, draft, pending and scheduled content."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MCP Server for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.8.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:32:30.666188Z","id":"CVE-2026-96526","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/79c3ae87-fc63-42b1-bb68-c7420060f9d4/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-96531","sourceIdentifier":"contact@wpscan.com","published":"2026-09-26T07:17:03.430","lastModified":"2026-09-28T15:17:09.083","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Optimole  WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user, such as an administrator, who views the post."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Optimole","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"4.2.13","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:32:18.859155Z","id":"CVE-2026-96531","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/15ad5748-8c2b-4c60-9818-57790f7033c7/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-96532","sourceIdentifier":"contact@wpscan.com","published":"2026-09-26T07:17:03.527","lastModified":"2026-09-28T15:17:09.083","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Testimonials Widget","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"4.0.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:32:07.793630Z","id":"CVE-2026-96532","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/d1372d8a-6654-4da7-a07e-87b18a0b0db9/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-96533","sourceIdentifier":"contact@wpscan.com","published":"2026-09-26T07:17:03.630","lastModified":"2026-09-28T15:17:09.083","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Testimonials Widget","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"4.0.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:31:53.625586Z","id":"CVE-2026-96533","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://wpscan.com/vulnerability/062284b2-b55d-42e2-8dda-ced7845d7df0/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-100311","sourceIdentifier":"cna@vuldb.com","published":"2026-09-26T08:16:32.133","lastModified":"2026-09-28T17:17:42.297","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of the file managevideos2.php of the component Faculty Video Management. Such manipulation of the argument V_Title/V_Url/V_Remarks leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"modules":["Faculty Video Management"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:01:55.324240Z","id":"CVE-2026-100311","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/raffarj/CVE/tree/main","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-100311","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/914572","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/410439","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/410439/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-100312","sourceIdentifier":"cna@vuldb.com","published":"2026-09-26T09:16:37.087","lastModified":"2026-09-30T02:16:55.340","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file /updateguest.php. Performing a manipulation of the argument gname/editassid results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:32:54.049360Z","id":"CVE-2026-100312","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/JaconiasDev/Advisory-CloundClassroom-PHP-Project-1.0","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-100312","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/914575","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/410440","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/410440/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-98163","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-26T09:16:38.303","lastModified":"2026-10-19T10:18:16.653","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup: Avoid iteration of dying tasks with zero refcount\n\nThe commit 260fbcb92bbea (\"cgroup: Move dying_tasks cleanup from\ncgroup_task_release() to cgroup_task_free()\") extended the lifetime of\ntasks on the dying_tasks list.\nThe iterators have provision to go through dying_tasks because of\ndying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however,\nit was expected that such tasks can obtain a new reference (that is\npossible before cgroup_task_release()/put_task_struct_rcu_user()).\nThe tasks after cgroup_task_release() and before cgroup_task_free()\nare subject to race when they may or may not have ->usage count > 0.\n\nThe race window is between css_task_iter_next() invocations\nwhen css_set_lock is released and we may arrive at a new ->task_pos.\nThe iterator should not attempt to resurrect tasks whose ->usage count\ndropped to zero. (When that happens, __put_task_struct_rcu_cb() is\nalready imminent and the returned task_struct would could be used\nafter free.)\n\nAs for the fix, we cannot simply check the signal->live count of a task\non the dying list because that won't distinguish regular zombies waiting\nto be reaped from RCU remnant tasks that are going to be free'd.\nTherefore add an extra check to rule out ->usage==0 tasks from any\niteration.\n\nThe repeat: loop in css_task_iter_advance() doesn't consider ->usage\ncount, so add a new loop to css_task_iter_next() to skip de-used tasks\non the dying_list.\n\nRough illustration of the possible race\n\n  R (reader of cgroup.procs)         T (thread)                       L (group leader)\n  ---------------------------------  -------------------------------- --------------------------------\n                                                                      L exits, signal->live > 0\n                                                                      cgroup_task_dead(L)\n                                                                        css_set_skip_task_iters() // skips only cset->tasks\n                                                                        list_add_tail(&L->cg_list, &cset->dying_tasks)\n  css_task_iter_next()\n    take css_set_lock\n    css_task_iter_advance()\n      leader && signal->live != 0\n      => it->task_pos = &L->cg_list\n    release css_set_lock\n                                     T exits\n                                     --signal->live == 0\n\t\t\t\t     cgroup_task_dead(T) // css_set_lock\n                                     release_task(T)\n                                       cgroup_task_release(T)\n                                       release_task(L) // zap_leader\n                                         cgroup_task_release(L)\n                                         put_task_struct_rcu_user(L)\n                                         ...RCU...\n                                         put_task_struct(L)\n                                           L->usage = 0\n                                           /* L still on dying_tasks */\n                                           ...RCU...\n                                           __put_task_struct(L)\n  css_task_iter_next() // another iteration\n    take css_set_lock\n    it->task_pos = &L->cg_list\n    get_task_struct(L)\n      => addition on 0\n    drop css_set_lock\n                                           cgroup_task_free(L)\n                                             css_set_skip_task_iters() // dying skip comes too late\n                                           free_task(L)\n  cgroup_procs_show()\n    task_pid_vnr(L)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/cgroup/cgroup.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"260fbcb92bbeacfcd050410fdc2d24ab15044400","lessThan":"828938118d6c2bb711301748c3e39e4bed6a62f5","versionType":"git","status":"affected"},{"version":"260fbcb92bbeacfcd050410fdc2d24ab15044400","lessThan":"057dac23d329d5c5ed62352f2659a39fd46c6d4a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/cgroup/cgroup.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.8","matchCriteriaId":"03F96438-F355-42FE-99A2-E7C298C7580F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*","matchCriteriaId":"14FD7B9A-4946-4511-8E63-6E13870CD4A8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc3:*:*:*:*:*:*","matchCriteriaId":"F06EDE17-AD0F-4C81-AF8C-D86B6AF0F622"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/057dac23d329d5c5ed62352f2659a39fd46c6d4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/828938118d6c2bb711301748c3e39e4bed6a62f5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-100313","sourceIdentifier":"cna@vuldb.com","published":"2026-09-26T12:17:33.267","lastModified":"2026-09-28T20:17:07.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. Executing a manipulation of the argument queryx can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T19:14:41.743465Z","id":"CVE-2026-100313","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/vinniboy021-blip/Advisory/blob/main/updatequery-stored-xss.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-100313","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/914577","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/410441","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/410441/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-100314","sourceIdentifier":"cna@vuldb.com","published":"2026-09-26T12:17:35.227","lastModified":"2026-09-28T17:17:42.463","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromstudent.php. The manipulation of the argument eno leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:03:03.145813Z","id":"CVE-2026-100314","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/vinniboy021-blip/Advisory/blob/main/updatedetailsfromstudent-sqli.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-100314","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/914582","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/410442","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/410442/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-100315","sourceIdentifier":"cna@vuldb.com","published":"2026-09-26T13:16:36.050","lastModified":"2026-09-30T02:16:55.960","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:35:02.170906Z","id":"CVE-2026-100315","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/vinniboy021-blip/Advisory/blob/main/mydetailsfaculty-sqli.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-100315","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/914583","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/410443","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/410443/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-100600","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:39.420","lastModified":"2026-10-05T16:17:02.383","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ClawHub (the openclaw/clawhub application/backend) does not bind anonymous HTTP API requests to a trusted caller identity, so all direct anonymous API requests share a single default quota allowance. A remote, unauthenticated caller can drain that shared allowance and thereby deny or degrade API access for unrelated visitors. In addition, when the TRUST_FORWARDED_IPS option is enabled without an authenticated edge/proxy, clients can supply arbitrary forwarded IP headers to select quota identities of their choosing and evade rate limiting. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. It is fixed in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (PR #3684), where direct anonymous calls are redirected to the public API origin without consuming quota and forged identity assertions return HTTP 401. The npm CLI and OpenClaw runtime are separate products and are not affected."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"clawhub","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","versionType":"git","status":"affected"},{"version":"8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","versionType":"git","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T16:06:11.161509Z","id":"CVE-2026-100600","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/openclaw/clawhub/commit/8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/clawhub/security/advisories/GHSA-4c7q-g7xf-5628","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/clawhub-before-8c2de6c506-quota-exhaustion-via-anonymous-api","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100601","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:40.040","lastModified":"2026-09-30T13:17:15.497","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolved network destination, so a public-looking hostname can resolve to an internal address or change resolution between validation and connection (DNS rebinding). A maintainer-run local harness demonstrated an outbound connection to an owner-controlled loopback listener; access to production internal services, credential disclosure, and code execution were not demonstrated. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. Fixed by PR #3683, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"clawhub","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","versionType":"git","status":"affected"},{"version":"8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","versionType":"git","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:47:07.077181Z","id":"CVE-2026-100601","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/openclaw/clawhub/commit/8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/clawhub/security/advisories/GHSA-48gp-hx8w-wjvm","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/clawhub-ssrf-via-unchecked-dns-resolution-in-profile-image","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100602","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:40.187","lastModified":"2026-09-29T21:33:56.530","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the public skills:generateChangelogPreview action for a skill they are not authorized to access; the previous version is read without the file-read authorization enforced on normal content access, and up to 8,000 characters of quarantined content may be submitted to the AI provider and reflected in the preview returned to the caller, disclosing restricted skill content. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. It is fixed by PR #3682, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"clawhub","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","versionType":"git","status":"affected"},{"version":"8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","versionType":"git","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T19:13:10.079746Z","id":"CVE-2026-100602","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/clawhub/commit/8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/clawhub/security/advisories/GHSA-g3jp-jj55-jrcr","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/clawhub-changelog-preview-information-disclosure-via-authorization-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100603","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:40.330","lastModified":"2026-09-29T21:33:56.530","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding (moderationStatus: hidden) of that skill from the catalog without any moderator decision. Because the reporter quota counts only reports filed against visible targets, the same accounts can repeat the process against additional skills; official skills are not exempt. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. The fix (PR #3681) is included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"clawhub","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","versionType":"git","status":"affected"},{"version":"8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","versionType":"git","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:05:07.198454Z","id":"CVE-2026-100603","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-799"}]}],"references":[{"url":"https://github.com/openclaw/clawhub/commit/8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/clawhub/security/advisories/GHSA-5jj4-m8c9-gwcq","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/clawhub-before-8c2de6c506-skill-hiding-via-coordinated-reports","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100604","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:40.473","lastModified":"2026-10-05T16:17:02.590","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its original publisher, and transfer and lifecycle authorization checks trust that historical user before requiring current organization privileges. An authenticated user who originally published an organization skill can therefore transfer, delete, or restore that skill — taking control of its trusted name and history — even after their organization privileges have been revoked or downgraded. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. It is fixed by PR #3680, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openclaw","product":"clawhub","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","versionType":"git","status":"affected"},{"version":"8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","versionType":"git","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:55:54.672113Z","id":"CVE-2026-100604","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/clawhub/commit/8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/clawhub/security/advisories/GHSA-9558-q4f9-324f","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/clawhub-authentication-bypass-via-former-publisher-skill-control","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100605","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:40.620","lastModified":"2026-09-30T13:17:15.667","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid but low-privileged API keys can access GET and DELETE chat message routes without required flow permissions to read chat histories, prompts, model responses, and delete messages."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"FlowiseAI","product":"Flowise","defaultStatus":"unaffected","packageURL":"pkg:npm/flowise","versions":[{"version":"0","lessThanOrEqual":"3.1.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:48:27.297528Z","id":"CVE-2026-100605","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-ppmg-4cx6-95hh","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/flowise-through-3.1.4-missing-authorization-via-chat-message-routes","source":"disclosure@vulncheck.com"},{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-ppmg-4cx6-95hh","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100606","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:40.820","lastModified":"2026-09-28T19:16:43.523","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin (SSOBase.ts:80-94) copies the user record from the database — including the server-stored single-use invitation tempToken — into the data passed to AccountService.register(). The register handler's token lookup, email match, and expiry checks therefore pass trivially against the server's own token instead of a caller-supplied one, and the account and its organization membership are flipped to ACTIVE. As a result, anyone able to authenticate at any configured SSO provider using a pending invitee's email address as the email claim can take over that invitation and obtain the invited user's access to the organization without ever possessing the emailed invitation token, for as long as the invitation is valid (24 hours by default). At the time of the advisory no patched version was available."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"FlowiseAI","product":"Flowise","defaultStatus":"unaffected","packageURL":"pkg:npm/flowise","versions":[{"version":"0","lessThanOrEqual":"3.1.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T19:08:17.212056Z","id":"CVE-2026-100606","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-vf3j-89vf-r697","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/flowise-through-3.1.4-authentication-bypass-via-sso-email-match","source":"disclosure@vulncheck.com"},{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-vf3j-89vf-r697","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100607","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:40.983","lastModified":"2026-09-28T18:17:14.233","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"FlowiseAI","product":"Flowise","defaultStatus":"unaffected","packageURL":"pkg:npm/flowise","versions":[{"version":"0","lessThanOrEqual":"3.1.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:07:19.926137Z","id":"CVE-2026-100607","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cffm-583c-vffr","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/flowise-through-3.1.4-authentication-bypass-via-email-only-sso","source":"disclosure@vulncheck.com"},{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cffm-583c-vffr","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100608","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:41.140","lastModified":"2026-10-05T16:17:02.830","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode (MODE=queue, ENABLE_BULLMQ_DASHBOARD=true, and !isCloud()), the /admin/queues mount is protected only by the verifyTokenForBullMQDashboard middleware, which validates the JWT but performs no role, permission, or workspace/organization scoping check; the mount also lies outside /api/v1/* so the global API gate does not apply. As a result, any authenticated user — including the lowest-privileged member of any tenant — can reach the full Bull-Board UI and view all queues and job payloads across the entire instance, including chat inputs and overrideConfig (which may carry credentials and prompts), chatflow.flowData graph definitions with custom function source code, credential IDs and system prompts, chatIds, files, and the originating orgId/workspaceId. The dashboard's write actions (retry, remove, promote, clean) are likewise usable across tenants. No patched version is available as of the advisory."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"FlowiseAI","product":"Flowise","defaultStatus":"unaffected","packageURL":"pkg:npm/flowise","versions":[{"version":"0","lessThanOrEqual":"3.1.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:57:25.782139Z","id":"CVE-2026-100608","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rpcc-gw54-mfgx","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/flowise-through-3.1.4-authorization-bypass-via-bullmq-dashboard","source":"disclosure@vulncheck.com"},{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rpcc-gw54-mfgx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100609","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:41.297","lastModified":"2026-09-30T13:17:15.820","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant (GET /api/v1/openai-assistants and /api/v1/openai-assistants/:id), uploadFilesToAssistant (POST /api/v1/openai-assistants-file/upload/), deleteAssistant (DELETE /api/v1/assistants/:id, reachable by first importing a poisoned assistant row via POST /api/v1/export-import/import), and the shared helper used by getVoices (GET /api/v1/text-to-speech/voices). An authenticated user of one workspace can supply a credential UUID belonging to another workspace, causing the server to decrypt and use that workspace's OpenAI or ElevenLabs API key on the attacker's behalf. No patched version was available at the time of publication."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"FlowiseAI","product":"Flowise","defaultStatus":"unaffected","packageURL":"pkg:npm/flowise","versions":[{"version":"0","lessThanOrEqual":"3.1.4","versionType":"semver","status":"affected"}]},{"vendor":"FlowiseAI","product":"Flowise","defaultStatus":"unaffected","packageURL":"pkg:npm/flowise-components","versions":[{"version":"0","lessThanOrEqual":"3.1.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:49:36.319783Z","id":"CVE-2026-100609","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-27w2-26m5-x82c","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/flowise-through-3.1.4-insecure-direct-object-reference-via-credential","source":"disclosure@vulncheck.com"},{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-27w2-26m5-x82c","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100610","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:41.460","lastModified":"2026-09-28T19:16:43.680","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory() returns UpsertHistory rows selected solely by an attacker-supplied chatflowid, and patchDeleteUpsertHistory() deletes rows by an attacker-supplied array of record UUIDs. As a result, any authenticated low-privilege user or valid API key can read or delete document-store upsert history belonging to other users and other workspaces whenever the target chatflowId (which is exposed publicly in /chatbot/<chatflowId> share links) or row ids are known. The retrievable flowData and result fields contain embedding, record-manager and vector-store node configuration, including per-node paramValues. No patched version is available."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"FlowiseAI","product":"Flowise","defaultStatus":"unaffected","packageURL":"pkg:npm/flowise","versions":[{"version":"0","lessThanOrEqual":"3.1.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T19:06:25.578629Z","id":"CVE-2026-100610","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jvx3-mjpw-r4gh","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/flowise-through-3.1.4-missing-authorization-via-upsert-history","source":"disclosure@vulncheck.com"},{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jvx3-mjpw-r4gh","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100611","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:41.610","lastModified":"2026-09-30T18:17:59.453","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly created API keys. When an authenticated user holding only apikey_manager (permissions org.manage_apikeys and org.read) calls POST /apikey with a JWT session, the only checks applied are the org.manage_apikeys permission, a fixed deny-list of assignable role names (APIKEY_MANAGER_DENIED_ASSIGNABLE_ROLES in public/apikey/scope.ts), and a priority-rank comparison in createRoleBindingForPrincipal (private/role_bindings.ts). No check verifies that the caller actually holds the permissions conferred by the role being assigned. Because the deny-list omits the deploy roles app_developer, app_uploader, channel_developer and channel_uploader, and apikey_manager is seeded with priority_rank 78 — higher than those roles' ranks (68, 66, 58, 57) — the rank check also passes. As a result, an apikey_manager who cannot upload bundles or promote channels can mint an API key bound to a deploy role and use it to push arbitrary OTA JavaScript updates to all end users of the organization's apps. As of the advisory publication no patched version was available."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"12.261.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:09:10.962717Z","id":"CVE-2026-100611","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-2x4j-p4pr-fvp8","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-apikey-manager-role-privilege-escalation-via-incomplete-role-deny-list","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-2x4j-p4pr-fvp8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100612","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:41.753","lastModified":"2026-09-30T21:16:53.937","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_direct_active_insert.sql installs a BEFORE UPDATE guard (enforce_sso_provider_client_update_guard()) that freezes only the dns_verified_at, domain, status and enforce_sso columns; provider_id (as well as metadata_url and attribute_mapping) is left writable. Because the table is granted ALL to the anon and authenticated roles with no column-level restriction, and PostgreSQL row-level security policies such as allow_org_admins_update_sso_providers constrain only which row may be updated and not which columns, a user holding the org_admin tier permission org.update_settings can PATCH provider_id over PostgREST to an identity provider under their control. Since provider_id is the trust anchor binding an email domain to an authorized IdP, the attacker can then authenticate through their own IdP while asserting the org owner's email; the server-side provider match succeeds and the merge routine attaches the attacker's SSO identity to the existing owner account, nulls its password, and deletes its other identities and sessions. This results in vertical privilege escalation from org_admin to org owner/super_admin, account takeover, and lockout of the legitimate owner. Exploitation requires that the target organization has an active SSO provider configured and that the attacker already holds org_admin in that organization. No patched version is available."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"12.261.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:43:11.354409Z","id":"CVE-2026-100612","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-jpjp-v827-j4gc","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-sso-provider-id-authentication-bypass-via-incomplete-migration","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100613","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:41.903","lastModified":"2026-09-30T18:17:59.730","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of publication), the `transfer_app()` database function transfers an app, its channels, versions and related records to a destination organization without deleting or revalidating existing rows in `channel_permission_overrides`. As a result, a user who legitimately held a channel permission override while a member of the source organization retains that override after the transfer, even though they have no membership and no RBAC binding in the destination organization. Using their own authenticated JWT against the PostgREST API, such a former member can modify the destination-owned channel to point at a different bundle, causing the /updates endpoint to serve an attacker-selected application version to devices. The previously proposed fix for GHSA-626c-p6fq-3whq (PR #3093), which validates organization membership when an override is created or updated, does not remove overrides that became stale as a result of an app transfer."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"*","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:50:39.829862Z","id":"CVE-2026-100613","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-6mj9-x3ww-rpj9","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-app-authorization-bypass-via-stale-channel-permission-overrides","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-6mj9-x3ww-rpj9","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100614","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:42.050","lastModified":"2026-09-28T20:57:50.143","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the service-role worker to download and re-upload that object with sanitized metadata. Attackers can silently modify metadata in cross-tenant image objects by supplying known victim keys during authorized row updates, bypassing storage access controls through the confused-deputy metadata worker."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.244.1","versionType":"semver","status":"affected"},{"version":"12.244.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T19:03:50.875420Z","id":"CVE-2026-100614","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-rcrw-pg2v-j9xg","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-before-12.244.1-cross-tenant-image-overwrite-via-metadata-worker","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-rcrw-pg2v-j9xg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100615","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:42.193","lastModified":"2026-09-28T20:57:50.143","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super_admin sibling key and recover its plaintext credential. Attackers with apikey_manager role can enumerate same-owner API keys, rotate a stronger sibling through the PUT endpoint, and obtain the replacement plaintext secret to authenticate as the higher-privileged principal."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.267.1","versionType":"semver","status":"affected"},{"version":"12.267.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:10:50.615430Z","id":"CVE-2026-100615","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-8h52-44r7-w343","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/cap-go-capgo-app-before-12.267.1-privilege-escalation-via-api-key-rotation","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-8h52-44r7-w343","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100616","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:42.333","lastModified":"2026-10-05T16:17:02.980","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an organization admin (a user holding org.update_settings) to update the entire row, including the internal billing pointer column customer_id. The official organization update endpoint (supabase/functions/_backend/public/organization/put.ts) allowlists only a small set of editable settings fields and excludes customer_id, and the private Stripe billing route separately requires the org.update_billing permission. By sending an update directly to Supabase PostgREST, an authenticated org admin without org.update_billing can null or corrupt the organization's Stripe customer pointer, causing plan and billing checks that trust orgs.customer_id to fail and moving the organization from a valid paid plan state to unpaid/no-plan behavior. At the time of the advisory no patched version was available."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"*","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T16:03:51.138448Z","id":"CVE-2026-100616","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-qp5h-v7x3-53cq","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-app-authentication-bypass-via-postgrest-customer-id-mutation","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-qp5h-v7x3-53cq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100617","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:42.467","lastModified":"2026-09-30T18:18:00.037","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant channel-scoped permissions such as channel.promote_bundle to users outside the organization."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"*","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:52:00.448236Z","id":"CVE-2026-100617","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-626c-p6fq-3whq","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/cap-go-capgo-app-authorization-bypass-via-channel-permission-overrides","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-626c-p6fq-3whq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100618","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:42.600","lastModified":"2026-09-30T18:18:00.187","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalizes it, and stores it in public.apps.icon_url without verifying that the image path belongs to the target app's own image namespace (e.g. org/{owner_org}/{app_id}/...). Updating apps.icon_url fires the on_app_update trigger, whose worker reads record.icon_url and calls cleanStoredImageMetadata(), which runs with service-role credentials (supabaseAdmin()) and downloads and re-uploads the referenced storage object with upsert: true. As a result, an authenticated holder of an app-limited write API key can cause the privileged worker to rewrite an out-of-scope private image object (for example an organization logo) that the key cannot read or write directly under Supabase Storage RLS. All versions are affected; no patched version was available at the time of the advisory."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"*","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T19:01:08.396450Z","id":"CVE-2026-100618","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-669c-gwrr-hc53","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-app-icon-update-privilege-escalation-via-service-role-worker","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-669c-gwrr-hc53","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100619","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:42.740","lastModified":"2026-09-30T18:18:00.330","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key (upload+ rights) or an authenticated user with write+ rights on an app can update public.app_versions.manifest on a version whose storage_provider is 'r2-direct', which is not covered by the bundle content-lock check. The on_version_update async worker trusts record.manifest and, using the service-role Supabase client, inserts the attacker-controlled file_name, file_hash, and s3_path into public.manifest before clearing app_versions.manifest. When a channel points to the crafted version, the /updates endpoint returns the service-role-created manifest entry as a client-facing download_url, enabling OTA manifest poisoning through a trusted async worker path. All versions are affected; no patch was available at the time of publication."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"*","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:13:54.114354Z","id":"CVE-2026-100619","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-443r-w5p8-rhr2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-ota-manifest-poisoning-via-app-versions-manifest-bypass","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-443r-w5p8-rhr2","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100620","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:42.877","lastModified":"2026-10-05T16:17:03.130","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CAN_MANAGE_DRAFT_APPS_GLOBAL (passed as developerAccountPermissions in the Android Publisher API User create request), even though the user-facing flow states the service account is invited into a single confirmed app with release-only permissions. As a result, anyone who obtains the generated service account key (PLAY_CONFIG_JSON) can create, edit, and delete draft apps across the entire Google Play developer account rather than being limited to the selected package. No patched version was available at the time of publication."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"@capgo/cli","defaultStatus":"unaffected","packageURL":"pkg:npm/%40capgo/cli","versions":[{"version":"0","lessThanOrEqual":"7.98.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","baseScore":3.8,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T16:01:34.217587Z","id":"CVE-2026-100620","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-wf94-285x-4cgj","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-cli-through-7.98.2-excessive-permissions-via-overpermissioned-play-console-service-account","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-wf94-285x-4cgj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100621","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:43.017","lastModified":"2026-09-30T18:18:00.470","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The `enforce_encrypted_bundle_trigger` / `check_encrypted_bundle_on_insert` content lock in supabase/schemas/prod.sql exempts `app_versions` rows whose previous `storage_provider` is `r2-direct`, so delivery-critical columns (name, app_id, session_key, key_id, storage_provider, r2_path, external_url, checksum, manifest, native_packages) remain mutable while a row is in that state. Separately, the channel/version join used by the `/updates` endpoint (supabase/functions/_backend/utils/pg.ts) filters only deleted versions and does not exclude `r2-direct` versions, so such rows remain OTA-selectable. An attacker holding a Capgo API key with bundle write/upload permission can create or keep a bundle version in the `r2-direct` state, assign it to a channel, and then modify these fields via direct PostgREST requests, causing altered bundle metadata (for example checksum and session_key) to be served to devices through `/updates`. This bypasses the post-upload content immutability hardening added for a previous app_versions metadata-tampering issue."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"*","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:53:37.679330Z","id":"CVE-2026-100621","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-5rg9-rhwj-wj76","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-app-content-lock-bypass-via-r2-direct-bundle-mutation","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-5rg9-rhwj-wj76","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100622","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:43.157","lastModified":"2026-09-28T20:57:50.143","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"12.129.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T18:58:06.734258Z","id":"CVE-2026-100622","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-26x3-6mr7-989p","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-app-through-12.129.0-cache-restoration-of-deleted-bundles","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-26x3-6mr7-989p","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100623","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:43.293","lastModified":"2026-09-30T18:18:00.610","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies \"Allow org admin to insert\" and \"Allow org admin to update\" only verify that the caller has admin rights in the target organization (public.check_min_rights('admin', ...)); they do not require a pending invitation in tmp_users, acceptance of an invite token via /private/accept_invitation, any action by the target user, or the membership/role-consistency and anti-escalation checks enforced by the RBAC role-binding path. As a result, an authenticated user who is an admin of an organization can INSERT or UPDATE org_users rows directly to add any existing public.users account as an active member of that organization with user_right=\"admin\", bypassing the invitation and role-assignment workflow entirely. In testing, an account with no prior access to the organization or its apps could, after such a direct insert, read the organization and app and pass check_min_rights. All versions are affected and no patch was available at the time of publication."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"*","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:59:45.447735Z","id":"CVE-2026-100623","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-w349-9mc3-8c5x","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-authentication-bypass-via-direct-postgrest-org-users-table-write","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-w349-9mc3-8c5x","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100624","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:43.430","lastModified":"2026-10-05T16:17:03.263","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an upload_expires_at timestamp (one hour) and a 'pending' status are stored in build_requests, but the upload proxy loads only app_id, owner_org, builder_job_id, and upload_path and checks only the app.build_native permission before forwarding POST, PATCH, and HEAD requests to the internal builder. As a result, an authenticated caller holding app.build_native permission for the app can continue writing to the build upload session after the stored expiry has passed or after the build has moved beyond the upload phase, unless the separate builder service independently rejects the request. The issue is fixed in 12.264.5."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.264.5","versionType":"semver","status":"affected"},{"version":"12.264.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:09:20.791725Z","id":"CVE-2026-100624","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-mqr8-g67p-jm26","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-app-before-12.264.5-upload-expiry-bypass-via-build-upload","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-mqr8-g67p-jm26","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100625","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:43.567","lastModified":"2026-09-30T18:18:00.750","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job's stored upload_path, but then forwards the user-controlled TUS resource suffix taken from /build/upload/:jobId/* to the builder service while injecting Capgo's privileged builder API key. Because the forwarded suffix is never bound to the authorized job's upload_path or upload_session_key, a caller holding a valid 'all' or 'write' Capgo API key with app.build_native permission for one application can use its authorized proxy path for job A to write to the TUS upload resource of another job B, provided that resource suffix is known or exposed, corrupting that build's artifacts. All versions are affected; no patch was available at the time of advisory publication."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"*","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:57:03.291979Z","id":"CVE-2026-100625","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-r45q-x4gr-3mvv","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-build-upload-proxy-authorization-bypass-via-tus-resource","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-r45q-x4gr-3mvv","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100626","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:43.703","lastModified":"2026-09-28T20:51:05.473","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days to read cross-tenant objects including user avatars, organization logos, and app icons without authorization."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"12.128.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:01:49.338171Z","id":"CVE-2026-100626","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-84xq-4rv7-p252","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-through-12.128.2-idor-via-put-app-icon-endpoint","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100627","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:43.837","lastModified":"2026-09-30T18:18:00.893","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to \"all\" and \"write\" API keys, dispatches to setChannel, which authorizes with checkPermission(c, 'channel.promote_bundle', { appId: body.app_id }) and omits the request's channel_id. Because the omitted scope field is passed to rbac_check_permission_direct as SQL NULL, and channel-scope override evaluation is gated on p_channel_id IS NOT NULL, per-channel allow/deny overrides are never evaluated. A principal holding app-level channel.promote_bundle (granted by default to the app_developer and app_uploader roles) can therefore promote a bundle to a channel for which an explicit per-channel deny override exists, updating public.channels.version for the supplied channel_id; the target channel is only validated after authorization. The issue is confirmed on main at commit de66fa51e7ff2f50283cc1455c3d80ab3eb0ae43 and likely earlier versions; no patched version is known at the time of publication."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"*","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T18:56:30.677663Z","id":"CVE-2026-100627","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-633x-9x77-77gf","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-bundle-promotion-api-channel-rbac-deny-override-bypass","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-633x-9x77-77gf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100628","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:43.977","lastModified":"2026-09-28T20:57:50.143","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply app_id but omit org_id, limited_to_orgs, and expires_at resolve the target app and scope the key to it, but never add the app's owner organization to the list of organization IDs passed to validateExpirationAgainstOrgPolicies; because that list is empty, the validation returns early. As a result, an authenticated organization member can create a non-expiring app-scoped API key even when the owning organization has require_apikey_expiration enabled and a max_apikey_expiration_days limit configured. The issue is fixed in version 12.128.12."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.128.12","versionType":"semver","status":"affected"},{"version":"12.128.12","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:57:00.983816Z","id":"CVE-2026-100628","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-j6p6-qqcg-3fwp","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-app-before-12.128.12-authentication-bypass-via-apikey","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-j6p6-qqcg-3fwp","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100629","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:44.117","lastModified":"2026-10-05T16:17:03.420","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the role currently bound to the target binding. An authenticated user holding the org_admin role (rank 90) can therefore change an org_super_admin binding (rank 95) to a lower-privileged role such as org_member (rank 75). Because the prevent_last_super_admin_binding_delete database trigger fires only BEFORE DELETE and not on UPDATE, an org_admin can demote every org_super_admin, leaving the organization with no super administrator. The issue is fixed in 12.127.5."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Cap-go","product":"capgo.app","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.127.5","versionType":"semver","status":"affected"},{"version":"12.127.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T16:07:56.183331Z","id":"CVE-2026-100629","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-54mj-q77q-xwx5","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/capgo-backend-before-12.127.5-privilege-escalation-via-role-bindings-patch","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-54mj-q77q-xwx5","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100630","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:44.260","lastModified":"2026-10-04T00:16:35.393","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL() validation and are decoded by the browser to break out of the JavaScript string, executing arbitrary code in any visitor's session including administrators."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"WWBN","product":"AVideo","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"29.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:59:45.467703Z","id":"CVE-2026-100630","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/WWBN/AVideo/commit/40b3267760924389c626a549bb1c6fd013b3b29c","source":"disclosure@vulncheck.com"},{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-v7vx-v9q9-qhw3","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/avideo-stored-xss-via-html-entity-bypass-in-trailer1-field","source":"disclosure@vulncheck.com"},{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-v7vx-v9q9-qhw3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100631","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:44.397","lastModified":"2026-09-30T17:23:08.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An unauthenticated remote attacker who knows only the public application ID can submit non-string values in these fields to inject query operators, causing the deduplication cleanup — which runs with elevated privileges before class-level permissions are evaluated — to delete every device registration in the application or an attacker-chosen subset of them. No account, session token, master key, or user interaction is required. Deleted registrations cannot be recovered on the server, so push notifications cannot be delivered until every client re-registers. Any deployment that exposes the REST API to clients and uses push notifications is affected in its default configuration. Versions 8.6.90 and 9.10.1-alpha.9 fix the issue by rejecting non-string values with a client error and by scoping the deduplication cleanup to the calling application. No workaround other than upgrading is available."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"parse-community","product":"parse-server","defaultStatus":"unaffected","packageURL":"pkg:npm/parse-server","versions":[{"version":"9.0.0","lessThan":"9.10.1-alpha.9","versionType":"semver","status":"affected"},{"version":"9.10.1-alpha.9","versionType":"semver","status":"unaffected"}]},{"vendor":"parse-community","product":"parse-server","defaultStatus":"unaffected","packageURL":"pkg:npm/parse-server","versions":[{"version":"0","lessThan":"8.6.90","versionType":"semver","status":"affected"},{"version":"8.6.90","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T18:55:32.254773Z","id":"CVE-2026-100631","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-943"}]}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-cc6h-c8m4-hgrx","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/parse-server-9.0.0-unauthenticated-installation-deletion-via-operator-injection","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100632","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:44.540","lastModified":"2026-09-30T17:23:08.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not supply its own session token the event payload is redacted against an anonymous identity even though the read was authorized against the connected user. As a result, field masks defined for a role, for authenticated users, or for a specific user are not applied, so an authenticated subscriber can receive field values that the REST API correctly withholds and can use a masked field to filter or watch a subscription. Only classes with LiveQuery enabled that define protectedFields under a role:, authenticated, or per-user group are affected; masks under the public (*) group are applied correctly. The issue is fixed in 9.10.1-alpha.8 and 8.6.89. As a workaround, additionally define the affected field masks under the public (*) group, or disable LiveQuery for classes whose class-level permissions rely on role-scoped, authenticated, or per-user protectedFields groups."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"parse-community","product":"parse-server","defaultStatus":"unaffected","packageURL":"pkg:npm/parse-server","versions":[{"version":"9.0.0","lessThan":"9.10.1-alpha.8","versionType":"semver","status":"affected"},{"version":"9.10.1-alpha.8","versionType":"semver","status":"unaffected"}]},{"vendor":"parse-community","product":"parse-server","defaultStatus":"unaffected","packageURL":"pkg:npm/parse-server","versions":[{"version":"0","lessThan":"8.6.89","versionType":"semver","status":"affected"},{"version":"8.6.89","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:48:42.606356Z","id":"CVE-2026-100632","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-9jpp-xhh6-75mf","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.1-protected-fields-disclosure-via-livequery","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100633","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:44.687","lastModified":"2026-10-05T16:17:03.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard (util.IsForbiddenAbsPath(), invoked from resolvePath()) is applied only to the allowed root of recursive operations and not to each resolved descendant path — an incomplete fix for GHSA-c8r8-95hg-mp34. An authenticated administrator using the in-app Agent or the external MCP server can therefore bypass the protected-workspace-file denylist: file.grep can return matching lines from non-hidden protected descendants (for example conf/conf.json, TLS keys, data/snippets/conf.json, data/templates/, data/.siyuan/publishAccess.json, notebook .siyuan internals, or the kernel log), file.copy can copy protected descendants to an ordinary path where file.read can then retrieve them, and unzip can overwrite protected descendants using ordinary, lexically contained ZIP member names. Because file.grep is globally classified as a safe action, it receives no per-call confirmation, and the confirmation cards for file.copy and unzip show only the allowed root arguments. This issue is fixed in version 3.8.4. Suggested title: SiYuan 3.8.0 through 3.8.3 Sensitive-Path Guard Bypass in Recursive MCP File Operations."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"3.8.0","lessThan":"3.8.4","versionType":"semver","status":"affected"},{"version":"3.8.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:20:59.180842Z","id":"CVE-2026-100633","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9g6v-r3xf-673q","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-3.8.0-through-3.8.3-path-traversal-via-mcp-file-operations","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100634","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:44.843","lastModified":"2026-10-08T16:16:57.413","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process (app/electron/main.js). The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows(), including windows belonging to other opened workspaces. A renderer connected to an attacker-controlled remote kernel can therefore send {cmd: \"lockscreenByMode\"} and have it delivered across the workspace boundary; a sibling workspace window whose lockScreenMode is set to 1 invokes lockScreen(). Repeated messages allow the remote workspace to repeatedly lock unrelated local workspace windows, causing a limited denial of service. No confidentiality, integrity, or code-execution impact was observed."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"0","lessThan":"3.8.4","versionType":"semver","status":"affected"},{"version":"3.8.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:01:06.934595Z","id":"CVE-2026-100634","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/commit/8641553a1f07374001902d3ce773285db1292b2d","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wxp7-xpq8-8xpm","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-3.8.4-missing-authorization-via-siyuan-send-windows","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wxp7-xpq8-8xpm","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100635","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:45.007","lastModified":"2026-10-08T16:16:57.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access authenticated publish endpoints without knowing the account password."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"0","lessThan":"3.8.4","versionType":"semver","status":"affected"},{"version":"3.8.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T18:53:29.876873Z","id":"CVE-2026-100635","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-319"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/commit/79d47867b106467c951475a9193455b48d1f3682","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/commit/ff4d215f78a8d6e6db6052be18b5f9f4db9c7d68","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7j37-4gq6-wm7m","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-3.8.4-authentication-bypass-via-plaintext-session-cookie","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7j37-4gq6-wm7m","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100636","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:45.160","lastModified":"2026-09-28T17:17:43.380","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences to escape the export directory and overwrite index.html in any pre-existing kernel-writable location, enabling stored XSS or workspace defacement."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan","versions":[{"version":"0","lessThan":"3.8.4","versionType":"semver","status":"affected"},{"version":"3.8.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:50:30.726443Z","id":"CVE-2026-100636","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jf98-m24w-gm9m","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-3.8.4-path-traversal-via-exportbrowserhtml-folder","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jf98-m24w-gm9m","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100637","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:45.320","lastModified":"2026-10-05T16:17:03.717","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON files in pre-existing kernel-writable directories outside workspace boundaries."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan","versions":[{"version":"0","lessThan":"3.8.4","versionType":"semver","status":"affected"},{"version":"3.8.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:06:28.154306Z","id":"CVE-2026-100637","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jhmh-hr4g-c5g2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-3.8.4-path-traversal-via-checkoutrepo-sessionid","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jhmh-hr4g-c5g2","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100638","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:45.480","lastModified":"2026-09-30T13:17:16.830","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitrary directory trees and write files outside the workspace boundary. Attackers can supply directory traversal sequences in the notebook parameter to escape the workspace data directory and write conf.json files to arbitrary locations accessible by the kernel process."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan","versions":[{"version":"0","lessThan":"3.8.4","versionType":"semver","status":"affected"},{"version":"3.8.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:01:55.950410Z","id":"CVE-2026-100638","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6h8x-6mph-7438","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-3.8.4-path-traversal-via-setnotebookicon","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6h8x-6mph-7438","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100639","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:45.633","lastModified":"2026-09-28T19:16:44.720","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts) from content pasted as plain-text Markdown containing a Kramdown inline attribute list (IAL). Because the shared Lute renderer parses Kramdown IAL from text/plain input, an attacker-supplied Markdown snippet using entity-encoded quotes in data-subtype breaks out of the attribute value when the gutter markup is re-parsed by the browser, injecting additional attributes such as autofocus and onfocus. If a victim pastes the crafted Markdown and the affected gutter control receives focus, the injected handler executes; in the Electron desktop application, where the main BrowserWindow enables Node integration and disables context isolation, this results in JavaScript execution with renderer Node.js privileges (remote code execution). Fixed in v3.8.4."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.8.4","versionType":"semver","status":"affected"},{"version":"3.8.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T18:49:39.724850Z","id":"CVE-2026-100639","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2cmm-9x9j-rvff","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-3.8.4-cross-site-scripting-via-kramdown-ial","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2cmm-9x9j-rvff","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100640","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:45.820","lastModified":"2026-10-08T16:16:57.727","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote renderer content can obtain MathML formulas, Office bytes, and WPS bytes from local clipboard during user-mediated paste operations."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"0","lessThan":"3.8.4","versionType":"semver","status":"affected"},{"version":"3.8.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:52:05.500068Z","id":"CVE-2026-100640","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mjmm-hgmc-m7qf","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-3.8.4-clipboard-data-disclosure-via-ipc","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mjmm-hgmc-m7qf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100641","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:46.080","lastModified":"2026-10-05T16:17:03.863","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content such as <img src=invalid onerror=...> becomes an executable event-handler attribute. Because the SiYuan desktop (Electron) main window is created with nodeIntegration enabled and contextIsolation disabled, an administrator who opens the card manager on a workspace containing attacker-supplied flashcard content (for example introduced through contribution or import) executes the attacker's script in a privileged renderer, which can lead to arbitrary code execution on the host. The affected endpoint remains behind authentication and administrator-role checks; this is an untrusted-content-to-privileged-renderer issue, not an authorization bypass."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.8.4","versionType":"semver","status":"affected"},{"version":"3.8.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:58:53.239401Z","id":"CVE-2026-100641","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/commit/1ecb1c07de497ff03b585536fe5579291754d96b","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/commit/41b14025b4ac4a8379d1200580344ca18ad152b7","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/commit/48c354e7de130aaada9d7120125bbc768344fd3b","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/commit/8641553a1f07374001902d3ce773285db1292b2d","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2mmf-4xwm-55rm","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-3.8.4-stored-xss-via-unescaped-flashcard-content","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2mmf-4xwm-55rm","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100642","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:46.247","lastModified":"2026-09-30T15:17:12.460","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to terminate the kernel process, read workspace configuration and proxy settings, and trigger administrative actions via zero-credential cross-origin requests from the victim's browser."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","versions":[{"version":"2.1.0","lessThan":"3.8.4","versionType":"semver","status":"affected"},{"version":"3.8.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:45:17.397705Z","id":"CVE-2026-100642","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9gpj-3rm3-x42m","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-2.1.0-before-3.8.4-cross-site-request-forgery-via-checkauth","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9gpj-3rm3-x42m","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100643","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:46.427","lastModified":"2026-09-28T19:16:44.867","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with nodeIntegration enabled, this leads to command execution with SiYuan process privileges."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"2.10.8","lessThan":"3.8.4","versionType":"semver","status":"affected"},{"version":"3.8.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T18:30:56.049987Z","id":"CVE-2026-100643","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h3p6-c22r-fx2j","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-3.8.4-stored-xss-via-attribute-view-textarea","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h3p6-c22r-fx2j","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100644","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:46.583","lastModified":"2026-10-08T16:16:57.890","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"0","lessThan":"3.8.4","versionType":"semver","status":"affected"},{"version":"3.8.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:38:36.495700Z","id":"CVE-2026-100644","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xr4h-j7cg-q8pc","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-3.8.4-sql-injection-via-dailynotesavepath","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xr4h-j7cg-q8pc","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100645","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:46.743","lastModified":"2026-10-08T16:16:58.060","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls Node.js child_process APIs to execute arbitrary commands with user privileges."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"3.7.0","lessThan":"3.8.4","versionType":"semver","status":"affected"},{"version":"3.8.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T17:55:16.020546Z","id":"CVE-2026-100645","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-556j-q8c8-qqg3","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-3.7.0-before-3.8.4-stored-xss-via-gallery-kanban","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-556j-q8c8-qqg3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100646","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:46.900","lastModified":"2026-09-30T15:21:53.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go) fail open when the HTTP Origin header is absent, on the incorrect assumption that any browser-initiated cross-site request carries an Origin. Because browsers omit Origin on cross-site top-level GET navigations and no-cors GET subresource loads — and the session cookie is SameSite=Lax — a single cross-site GET issued from any attacker-controlled web page is granted RoleAdministrator, both on default installations with no access-authorization code and on password-protected instances with a live session. Combined with content-type sniffing on the /api/network/proxy endpoint, which allows attacker-controlled HTML to be served under SiYuan's own origin, this permits an unauthenticated remote attacker to execute arbitrary script in the SiYuan origin (http://127.0.0.1:6806), invoke administrator APIs, and exfiltrate the persistent kernel API token. This issue is fixed in version 3.8.4."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan","versions":[{"version":"0","lessThan":"3.8.4","versionType":"semver","status":"affected"},{"version":"3.8.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:46:38.827782Z","id":"CVE-2026-100646","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2w6q-wgc8-q743","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-3.8.4-authentication-bypass-via-missing-origin-header","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2w6q-wgc8-q743","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100647","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:47.097","lastModified":"2026-10-06T19:46:06.527","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP requests with multi-hundred-megabyte salt values that trigger expensive pickle serialization and SHA-256 hashing, stalling the scheduler thread and denying service to all concurrent requests."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"vllm-project","product":"vllm","defaultStatus":"unaffected","packageURL":"pkg:pypi/vllm","versions":[{"version":"0","lessThan":"0.29.0","versionType":"semver","status":"affected"},{"version":"0.29.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T18:26:37.598538Z","id":"CVE-2026-100647","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndExcluding":"0.29.0","matchCriteriaId":"52A0C3A3-462E-41A5-BB3D-8E5780F390D2"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-wpww-v874-ph2p","source":"disclosure@vulncheck.com","tags":["Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/vllm-before-0.29.0-cpu-exhaustion-via-unbounded-cache-salt","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-100648","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:47.240","lastModified":"2026-10-06T19:40:20.020","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decoding."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"vllm-project","product":"vllm","defaultStatus":"unaffected","packageURL":"pkg:pypi/vllm","versions":[{"version":"0","lessThan":"0.29.0","versionType":"semver","status":"affected"},{"version":"0.29.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:40:22.871965Z","id":"CVE-2026-100648","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndExcluding":"0.29.0","matchCriteriaId":"52A0C3A3-462E-41A5-BB3D-8E5780F390D2"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-jcq2-4gch-5qhf","source":"disclosure@vulncheck.com","tags":["Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/vllm-before-0.29.0-uncontrolled-resource-consumption-via-audio-decoding","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-100649","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:47.380","lastModified":"2026-10-06T19:37:35.050","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits and exhaust unaccounted GPU memory."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"vllm-project","product":"vllm","defaultStatus":"unaffected","packageURL":"pkg:pypi/vllm","versions":[{"version":"0","lessThan":"0.29.0","versionType":"semver","status":"affected"},{"version":"0.29.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T18:00:00.754862Z","id":"CVE-2026-100649","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndExcluding":"0.29.0","matchCriteriaId":"52A0C3A3-462E-41A5-BB3D-8E5780F390D2"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-j682-9xp5-rrf3","source":"disclosure@vulncheck.com","tags":["Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/vllm-before-0.29.0-resource-limit-bypass-via-sampler-subclass","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-100650","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:47.523","lastModified":"2026-10-06T19:32:45.337","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits). Across four ingress paths — the shared media-acquisition layer (HTTPConnection.get_bytes()/async_get_bytes()), the chat completions audio_url/base64 path, the batch speech runner, and the Rust frontend POST /tokenize route — the server reads the entire HTTP response body, base64-decodes the inline payload, or spawns one fetch/decode task per media part, and only then applies the limit (or, on some paths, never applies it). A remote attacker can therefore cause the API server or batch-runner process to allocate memory and consume outbound bandwidth proportional to an attacker-chosen body size or media item count before the request is rejected, resulting in pre-inference memory and bandwidth exhaustion (denial of service). The chat and batch surfaces require an API key when one is configured; the Rust frontend /tokenize route is unauthenticated by design. There is no code execution or data disclosure impact."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"vllm-project","product":"vllm","defaultStatus":"unaffected","packageURL":"pkg:pypi/vllm","versions":[{"version":"0","lessThan":"0.29.0","versionType":"semver","status":"affected"},{"version":"0.29.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:49:40.322864Z","id":"CVE-2026-100650","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndIncluding":"0.29.0","matchCriteriaId":"01EA255A-DAD3-48B9-8D88-DDB93CA03A82"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/commit/752a3a504485790a2e8491cacbb35c137339ad34","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-p6g9-7v3x-m8mv","source":"disclosure@vulncheck.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/vllm-before-0.29.0-resource-exhaustion-via-unbounded-media-materialization","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-p6g9-7v3x-m8mv","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100651","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:47.663","lastModified":"2026-10-06T19:30:25.503","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' (multimodal) payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal EngineInput directly from the caller-supplied token_ids, and GenerateRequest.token_ids (vllm/entrypoints/serve/disagg/protocol.py) is not checked against model_config.max_model_len. For multimodal processors that report skip_prompt_length_check=True (for example Nemotron Parse, Whisper, and FireRedLID), InputProcessor._validate_prompt_len() returns immediately for both encoder and decoder prompts, so an overlong prompt becomes an EngineCoreRequest and reaches the worker input-batch copy into a fixed max_model_len-wide NumPy row. A client able to reach the endpoint on an affected model configuration can therefore submit an overlong token_ids list to trigger a worker failure and denial of service. Fixed in 0.29.0."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"vllm-project","product":"vllm","defaultStatus":"unaffected","packageURL":"pkg:pypi/vllm","versions":[{"version":"0","lessThan":"0.29.0","versionType":"semver","status":"affected"},{"version":"0.29.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T18:21:26.899493Z","id":"CVE-2026-100651","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndExcluding":"0.29.0","matchCriteriaId":"52A0C3A3-462E-41A5-BB3D-8E5780F390D2"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-3mqx-f33v-vgp9","source":"disclosure@vulncheck.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/vllm-before-0.29.0-denial-of-service-via-decoder-prompt-length-bypass","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-3mqx-f33v-vgp9","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100652","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:47.810","lastModified":"2026-10-06T19:22:01.530","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids to trigger CUDA tensor indexing failures that leave EngineCore in a fatal state requiring service restart."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"vllm-project","product":"vllm","defaultStatus":"unaffected","packageURL":"pkg:pypi/vllm","versions":[{"version":"0.22.0","lessThan":"0.24.0","versionType":"semver","status":"affected"},{"version":"0.24.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:41:47.920735Z","id":"CVE-2026-100652","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionStartIncluding":"0.22.0","versionEndExcluding":"0.24.0","matchCriteriaId":"D7860DB8-F910-4CD7-92D1-4775DA105A7F"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-qff2-492f-9fm4","source":"disclosure@vulncheck.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/vllm-0.22.0-through-0.23.0-denial-of-service-via-stop-token-ids","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-100653","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:47.953","lastModified":"2026-10-20T18:35:50.567","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast loads in vllm/model_executor/models/funaudiochat.py and the Qwen2VLConfig.from_pretrained call used by Tarsier2ProcessingInfo in vllm/model_executor/models/qwen2_vl.py. As a result, deployments pinned to a reviewed revision still resolve these behavior-affecting processor, tokenizer, and config artifacts from the repository's default revision, so a later change to the upstream default branch can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. This is a supply-chain integrity and reproducibility failure for pinned deployments; it is residual to the earlier fix tracked as GHSA-3ww4-5jv9-j5gm / CVE-2026-47155 and does not constitute remote code execution or a trust_remote_code=False bypass. The issue is fixed in version 0.28.0."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"vllm-project","product":"vllm","defaultStatus":"unaffected","packageURL":"pkg:pypi/vllm","versions":[{"version":"0.22.1","lessThan":"0.28.0","versionType":"semver","status":"affected"},{"version":"0.28.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:46:29.258369Z","id":"CVE-2026-100653","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-348"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionStartIncluding":"0.22.1","versionEndExcluding":"0.28.0","matchCriteriaId":"973946CD-DAA6-4E53-BED3-C039D3F29591"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/commit/d26a28ab033697f55a1414b5b0435de7cd6045b6","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-hhv2-872h-628q","source":"disclosure@vulncheck.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/vllm-0.22.1-before-0.28.0-incomplete-artifact-pin-propagation","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-hhv2-872h-628q","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100654","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:48.100","lastModified":"2026-10-07T17:33:53.093","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When min_tokens > 0, the stop token ids are used as logits indices to suppress stop tokens, so an out-of-range id reaches a CUDA indexing operation (index_put_) and triggers a device-side assertion. An authenticated API user can send a single malformed completion request that returns 500 Internal Server Error and puts EngineCore into a fatal state, causing subsequent requests to fail until the service is restarted (denial of service)."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"vllm-project","product":"vllm","defaultStatus":"unaffected","packageURL":"pkg:pypi/vllm","versions":[{"version":"0","lessThan":"0.29.0","versionType":"semver","status":"affected"},{"version":"0.29.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:51:29.949766Z","id":"CVE-2026-100654","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-129"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndExcluding":"0.29.0","matchCriteriaId":"52A0C3A3-462E-41A5-BB3D-8E5780F390D2"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-v5gm-qgmv-gc6c","source":"disclosure@vulncheck.com","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/vllm-before-0.29.0-denial-of-service-via-out-of-range-stop-token-ids","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-100655","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:48.243","lastModified":"2026-09-28T22:17:30.120","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected as a duplicate."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-100656","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:48.390","lastModified":"2026-09-28T22:17:30.207","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected as a duplicate."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-100657","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:48.540","lastModified":"2026-09-28T22:17:30.273","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected as a duplicate."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-100658","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:48.687","lastModified":"2026-09-28T22:17:30.340","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected as a duplicate."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-100659","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:48.830","lastModified":"2026-09-28T19:16:45.480","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single HEADERS frame containing both fields with differing, attacker-controlled values; the request is accepted and delivered to the application with two conflicting authorities, allowing routing, virtual-host, and access-control decisions to be bypassed when different components in the request path consult different fields. This issue is fixed in 4.2.18.Final."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"netty","product":"netty","defaultStatus":"unaffected","packageURL":"pkg:maven/io.netty/netty-codec-http3","versions":[{"version":"4.2.0.Final","lessThan":"4.2.18.Final","versionType":"custom","status":"affected"},{"version":"4.2.18.Final","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T18:16:52.799456Z","id":"CVE-2026-100659","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-444"}]}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-q9pg-8h3j-8hvm","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/netty-4.2.0-through-4.2.18-http-3-request-routing-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100660","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:48.970","lastModified":"2026-09-28T17:17:44.247","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controlled QUIC stream ID, and these entries are released only when the remote decoder sends a Section Acknowledgment or Stream Cancellation instruction — not when the HTTP/3 stream completes. There is no limit on the number of tracked streams, field sections, or retained bytes. A remote, unauthenticated HTTP/3 client can advertise a non-zero QPACK dynamic-table capacity, acknowledge the table insertion so the server reuses a dynamically indexed response header, and then omit all mandatory Section Acknowledgments while issuing sequential requests over a single QUIC connection, bypassing concurrent-stream limits and causing unbounded heap growth until the server exhausts memory (denial of service). Fixed in 4.2.18.Final."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"netty","product":"netty","defaultStatus":"unaffected","packageURL":"pkg:maven/io.netty/netty-codec-http3","versions":[{"version":"0","lessThan":"4.2.18.Final","versionType":"custom","status":"affected"},{"version":"4.2.18.Final","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:45:17.094549Z","id":"CVE-2026-100660","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/netty-before-4.2.18-final-qpackencoder-unbounded-memory-retention","source":"disclosure@vulncheck.com"},{"url":"https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100661","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:49.110","lastModified":"2026-10-02T21:16:53.830","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A remote, unauthenticated peer can open a QPACK unidirectional stream (type 0x02 encoder or 0x03 decoder) and send a first byte with all prefix bits set (e.g. 0xFF for a 7-bit prefix or 0x3F for a 5-bit prefix) followed by an endless run of 0x80 continuation bytes. The decoder returns -1 ('need more bytes'), so callers never consume the input, the ByteToMessageDecoder cumulator grows without bound, and each decode() invocation re-scans the whole accumulated buffer, yielding O(N^2) CPU cost. The result is unbounded per-connection heap growth (OutOfMemoryError) and event-loop CPU starvation, reachable in every configuration. Fixed in 4.2.18.Final."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"netty","product":"netty","defaultStatus":"unaffected","packageURL":"pkg:maven/io.netty/netty-codec-http3","versions":[{"version":"4.2.0.Final","lessThan":"4.2.18.Final","versionType":"custom","status":"affected"},{"version":"4.2.18.Final","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T20:46:18.296589Z","id":"CVE-2026-100661","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/netty-http-3-qpack-prefixed-integer-dos-via-unbounded-accumulation","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100662","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:49.257","lastModified":"2026-09-30T15:22:15.423","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02). The handler accepts an attacker-declared string-literal length of up to Integer.MAX_VALUE (~2 GiB) for the Name Length and Value Length fields of the \"Insert With Literal Name\" instruction (RFC 9204 §4.3.3), with no per-instruction or per-literal length cap and no cumulation-size limit; the existing HTTP/3 limits (maxHeaderListSize, maxUnknownFramePayloadLength, DEFAULT_MAX_FIELD_SECTION_SIZE) are not applied to this handler. A remote, unauthenticated peer with an established HTTP/3 connection to a default Netty HTTP/3 server can declare a very large literal length and then trickle fewer bytes than declared, causing the ByteToMessageDecoder MERGE cumulator to retain and grow the per-connection buffer, and ultimately triggering a large byte-array allocation. This leads to unbounded per-connection heap growth and OutOfMemoryError, resulting in denial of service. Fixed in 4.2.18.Final."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"netty","product":"netty","defaultStatus":"unaffected","packageURL":"pkg:maven/io.netty/netty-codec-http3","versions":[{"version":"4.2.0.Final","lessThan":"4.2.18.Final","versionType":"custom","status":"affected"},{"version":"4.2.18.Final","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:53:08.105333Z","id":"CVE-2026-100662","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-f64r-x647-cg8w","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/netty-http-3-qpack-encoder-stream-unbounded-memory-exhaustion-dos","source":"disclosure@vulncheck.com"},{"url":"https://github.com/netty/netty/security/advisories/GHSA-f64r-x647-cg8w","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100663","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:49.400","lastModified":"2026-09-28T19:16:45.613","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target (e.g., \"CONNECT trusted.example:443\") is parsed as a URI, so its host is emitted as :scheme, :path is set to \"/\", and the HTTP/1 Host header is used as :authority; if no Host header is present the CONNECT target is dropped. In a Netty-based HTTP/1-to-HTTP/3 proxy or gateway, a remote client can send a CONNECT request whose Host header names a different authority than the request-target, producing a malformed HTTP/3 CONNECT whose tunnel :authority is attacker-controlled. This can bypass tunnel allow-lists, egress policy, backend selection, or audit controls that validate the HTTP/1 CONNECT request-target before forwarding over HTTP/3. The issue is fixed in 4.2.18.Final."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"netty","product":"netty","defaultStatus":"unaffected","packageURL":"pkg:maven/io.netty/netty-codec-http3","versions":[{"version":"4.2.2.Final","lessThan":"4.2.18.Final","versionType":"custom","status":"affected"},{"version":"4.2.18.Final","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T18:48:08.213536Z","id":"CVE-2026-100663","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/netty-http-1-connect-authority-form-mistranslated-to-malformed-http-3","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100664","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:49.540","lastModified":"2026-09-28T17:17:44.387","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3Headers(HttpMessage, boolean) — reached via Http3FrameToHttpObjectCodec(false) — a non-empty Host header takes precedence over the request-target authority, contrary to the HTTP/1.1 rule that a server receiving an absolute-form request-target must ignore the Host header. In a Netty-based HTTP/1-to-HTTP/3 gateway, proxy, or protocol bridge, a remote client can send a request such as \"GET https://trusted.example/admin HTTP/1.1\" with \"Host: attacker.example\", causing components that validate, authorize, or route on the RFC-defined request-target authority to reach a different decision than the upstream HTTP/3 peer, which receives :authority derived from the conflicting Host header. This authority confusion can affect virtual-host routing, allow-list checks, backend selection, cache keys, and URL generation. The advisory reports integrity impact only (no code execution, memory corruption, or availability impact). Fixed in 4.2.18.Final."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"netty","product":"netty","defaultStatus":"unaffected","packageURL":"pkg:maven/io.netty/netty-codec-http3","versions":[{"version":"4.2.2.Final","lessThan":"4.2.18.Final","versionType":"custom","status":"affected"},{"version":"4.2.18.Final","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:46:54.123062Z","id":"CVE-2026-100664","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-hfr2-x62w-v49h","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/netty-4.2.2-through-4.2.15-http-1-host-header-authority-confusion","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100665","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:49.677","lastModified":"2026-10-02T16:16:41.803","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. Attackers on the network path can present a certificate chain for the wrong hostname that the plain trust manager accepts, bypassing hostname authentication for QUIC clients."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"netty","product":"netty","defaultStatus":"unaffected","packageURL":"pkg:maven/io.netty/netty-codec-classes-quic","versions":[{"version":"4.2.11.Final","lessThan":"4.2.18.Final","versionType":"custom","status":"affected"},{"version":"4.2.18.Final","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T15:46:31.371553Z","id":"CVE-2026-100665","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://github.com/netty/netty/commit/09e72c4fd8007277121ed48db63a124b112b96fe","source":"disclosure@vulncheck.com"},{"url":"https://github.com/netty/netty/commit/994e887ed9","source":"disclosure@vulncheck.com"},{"url":"https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/netty-4.2.11-through-4.2.17-quic-hostname-verification-bypass","source":"disclosure@vulncheck.com"},{"url":"https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100666","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:49.830","lastModified":"2026-09-30T15:22:15.610","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method, so the subsequent 200 OK for the GET is paired with HEAD and its body is dropped, while the following 200 OK for the HEAD request is written with a body. This desynchronizes HTTP parsing on the connection: the GET entity is never delivered and the HEAD response body is interpreted as the GET body, resulting in response splitting and unsafe connection reuse. Fixed in 4.2.17.Final and 4.1.137.Final."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"netty","product":"netty","defaultStatus":"unaffected","packageURL":"pkg:maven/io.netty/netty-codec-http","versions":[{"version":"4.2.0.Final","lessThan":"4.2.17.Final","versionType":"custom","status":"affected"},{"version":"4.2.17.Final","versionType":"custom","status":"unaffected"}]},{"vendor":"netty","product":"netty","defaultStatus":"unaffected","packageURL":"pkg:maven/io.netty/netty-codec-http","versions":[{"version":"0","lessThan":"4.1.137.Final","versionType":"custom","status":"affected"},{"version":"4.1.137.Final","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:54:21.422528Z","id":"CVE-2026-100666","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-444"}]}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-2g6j-r8q9-5hr8","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/netty-4.2.0-through-4.2.17-response-desynchronization-via-httpservercodec","source":"disclosure@vulncheck.com"},{"url":"https://github.com/netty/netty/security/advisories/GHSA-2g6j-r8q9-5hr8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100667","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:50.113","lastModified":"2026-09-28T19:16:45.757","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with 2FA enabled, Login::isAuthenticated() checked only the session flag indicating that the password step had succeeded, not the flag indicating that login had completed, so a session sitting at the 2FA code prompt was treated as fully authenticated. An attacker who knows a member's password but cannot answer that member's second factor can therefore read member-only content rendered by the no-argument authenticated() or group authenticated(null, 'group') forms and by [authenticated]; the inverse [guest] shortcode is likewise evaluated too early. Impact is limited to disclosure of that content: the attacker does not obtain a completed session, cannot access pages protected by an access: rule, and cannot act as the user. The authenticated('some.permission') form, which goes through UserObject::authorize(), is not affected. Fixed in grav-plugin-login 3.9.7."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"getgrav","product":"grav","defaultStatus":"unaffected","versions":[{"version":"3.8.7","lessThan":"3.9.7","versionType":"semver","status":"affected"},{"version":"3.9.7","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T18:12:38.035267Z","id":"CVE-2026-100667","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-304"}]}],"references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-636m-8598-45r9","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/grav-plugin-login-3.8.7-through-3.9.6-two-factor-authentication-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100668","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:50.273","lastModified":"2026-09-28T17:17:44.527","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is on the sandbox allowlist but is registered without the needs_is_sandboxed guard that print_r, vardump, json_encode, yaml_encode and string carry, and its implementation calls toArray() — or falls back to an (array) cast — without consulting the sandbox method allowlist. Because the `grav` Twig global is the raw Pimple-based dependency injection container, a user who can author Twig in page content can evaluate `grav|array` to read the container's private $values array, including the un-redacted Config service; a second array cast returns the entire configuration tree, disclosing plugin credentials, SMTP and OAuth secrets, Redis passwords, proxy URLs and the security.* subtree that the sandbox's redaction is meant to hide. Because the payload is stored in page content, the disclosed configuration is rendered to anonymous visitors. Grav 1.7 is not affected as it has no Twig content sandbox. Fixed in Grav 2.0.25."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"getgrav","product":"grav","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.0.25","versionType":"semver","status":"affected"},{"version":"2.0.25","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:31:14.290588Z","id":"CVE-2026-100668","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-59qm-58v5-gvc5","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/grav-before-2.0.25-sandbox-escape-via-array-filter","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100669","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:50.427","lastModified":"2026-09-30T21:16:54.070","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config (IIS), every deny rule (user_sensitive_folders, user_accounts, user_data, user_error_redirect, user_pages, system, vendor, ignore_folders) sets ignoreCase=\"false\" on its URL Rewrite <match> element, overriding the IIS default of ignoreCase=\"true\"; because these are rewrite matches rather than <requestFiltering> elements, there is no case-insensitive fallback. On IIS running over case-insensitive NTFS, an unauthenticated remote attacker can vary the case of a folder name or file extension (for example GET /user/CONFIG/system.YAML) so that no deny rule matches and the IIS static file handler resolves and returns the underlying file, disclosing sensitive data such as configuration secrets or account password hashes. Whether a bypassed file is actually returned depends on MIME registration: .json is served by default, while .yaml/.yml return HTTP 404.3 on a stock IIS unless a YAML MIME mapping has been added. The same class of gap exists in the bundled webserver-configs/lighttpd.conf, whose user/(config|env), directory, script-extension, root-file and dotfile rules lack the (?i) modifier, though it is lower risk because lighttpd typically runs on case-sensitive filesystems. Deployments served by Apache (.htaccess), nginx, Caddy, or the PHP built-in server are not affected. The issue is fixed in 2.0.25; because the .htaccess installer heal does not touch web.config or lighttpd.conf, operators must re-copy the corrected sample files after upgrading."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"getgrav","product":"grav","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.0.25","versionType":"semver","status":"affected"},{"version":"2.0.25","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:44:31.966178Z","id":"CVE-2026-100669","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-178"}]}],"references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-pg8v-xw58-frq8","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/grav-before-2.0.25-sensitive-file-disclosure-via-case-variation-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100670","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:50.583","lastModified":"2026-09-30T15:22:15.837","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a `security@: admin.super` guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as `access.admin.super` (instead of the nested `access[admin][super]`) matches no blueprint rule, survives BlueprintSchema::filterArray() and flattening, and is written by FlexObject::update() via setNestedProperty(), which splits on `.` and reconstructs the nested value. An authenticated backend operator using the flex accounts backend who holds admin.users but not admin.super can therefore grant admin.super to their own account or to a group they belong to and escalate to full super-admin, gaining control over configuration, plugin and theme installation, the file manager, and all accounts. Fixed in 2.0.25, which drops any dotted key whose ancestor path is disabled or marked validate.ignore."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"getgrav","product":"grav","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.0.25","versionType":"semver","status":"affected"},{"version":"2.0.25","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:57:11.982511Z","id":"CVE-2026-100670","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-mwjj-r7vm-pgqm","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/grav-cms-2.0.14-through-2.0.24-privilege-escalation-via-blueprint-guard-bypass","source":"disclosure@vulncheck.com"},{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-mwjj-r7vm-pgqm","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100671","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:50.743","lastModified":"2026-09-28T19:16:45.903","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists get_cookie(), which returns any cookie sent with the current request, including the visitor's session cookie. Because the read occurs server-side via filter_input(INPUT_COOKIE, ...), the HttpOnly, Secure and SameSite attributes offer no protection. Grav then stores the finished post-Twig output in a page-content cache keyed only on page identity and the configuration checksum, with no session, user or request dimension and no bypass for authenticated visitors. A page published by a page-write user can therefore capture the session identifier of the next administrator who views it, after which the cached output serves that identifier to unauthenticated visitors, who can replay the cookie to authenticate as that administrator. Since 2.0.19, security.twig_content.process_enabled defaults to true and Security::applyTwigContentDefault() derives each page's process.twig flag from that gate, so content Twig runs on every page with no frontmatter or operator action. Fixed in 2.0.25; 1.7.x is outside the backport scope."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"getgrav","product":"grav","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.0.25","versionType":"semver","status":"affected"},{"version":"2.0.25","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T18:09:48.724355Z","id":"CVE-2026-100671","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-pp89-h475-7gj6","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/grav-before-2.0.25-session-cookie-theft-via-twig-sandbox","source":"disclosure@vulncheck.com"},{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-pp89-h475-7gj6","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100672","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:50.970","lastModified":"2026-09-28T17:17:44.670","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin(), which only indicates that the admin service is registered on the current route rather than that the visitor is authenticated, and it echoes the JSON and calls exit() during the plugins stage, before the classic Admin plugin would render its login screen. On a site using the classic Admin plugin with Comments enabled (the default), an unauthenticated remote attacker can request /admin/comments/page:<n> (e.g. page:0.001) and retrieve every comment from the last 7 days, including each commenter's email address and the absolute server filesystem path of the data file. Sites running the Grav 2.0 Admin Next stack (admin2 + api) are not affected via this path. The issue is fixed in 1.2.11, which requires an authenticated user with admin.comments or admin.super and removes the absolute filePath from the response."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"getgrav","product":"grav-plugin-comments","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.2.11","versionType":"semver","status":"affected"},{"version":"1.2.11","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:31:47.741599Z","id":"CVE-2026-100672","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-3cq9-f4pf-hq59","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/grav-plugin-comments-before-1.2.11-unauthenticated-information-disclosure","source":"disclosure@vulncheck.com"},{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-3cq9-f4pf-hq59","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100673","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:51.133","lastModified":"2026-09-30T21:16:54.203","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/partials/item.html.twig) without escaping, applying Twig's `raw` filter — in some cases after a striptags('<br>') call that PHP's strip_tags() bypasses by preserving allowed tags together with their attributes. An unauthenticated visitor who submits a front-end form whose submissions are saved to user/data can store an HTML payload that executes as JavaScript in the session and origin of an administrator who later opens that entry in the classic admin panel, running with that administrator's privileges and CSRF token. Execution occurs without further interaction for list values (such as checkbox or multi-select fields) and on hover for ordinary text fields. Sites using the Grav 2.0 Admin Next interface are not affected, because it renders the same data through a separate, correctly escaping code path. The issue is fixed in Data Manager 1.4.5."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"getgrav","product":"grav-plugin-datamanager","defaultStatus":"unaffected","versions":[{"version":"1.0.1","lessThan":"1.4.5","versionType":"semver","status":"affected"},{"version":"1.4.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:43:46.378427Z","id":"CVE-2026-100673","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-863q-9v8v-m9fv","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/grav-data-manager-before-1.4.5-stored-xss-via-item-detail-view","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100674","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:51.297","lastModified":"2026-09-30T15:22:16.023","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create reserved-name lookalikes, embed special characters, and exceed the 32-character storage limit."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"stoatchat","product":"stoatchat","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"0.15.5","versionType":"semver","status":"affected"},{"version":"0.15.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:58:48.896666Z","id":"CVE-2026-100674","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-180"}]}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qcwh-c934-wrv5","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-username-validation-bypass-via-unicode-sanitization","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100675","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:51.440","lastModified":"2026-09-28T18:17:14.860","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges deployment-wide until the API process restarts."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"stoatchat","product":"stoatchat","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"0.15.5","versionType":"semver","status":"affected"},{"version":"0.15.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T18:05:58.547883Z","id":"CVE-2026-100675","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-248"}]}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-5gq6-v4cf-3qq8","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-denial-of-service-via-mass-mentions","source":"disclosure@vulncheck.com"},{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-5gq6-v4cf-3qq8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100676","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:51.577","lastModified":"2026-09-28T17:17:44.810","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG <image href> values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG (e.g. via the /proxy endpoint) can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding. Because each referenced file is read in full with no effective limit on the number or total volume of reads, a single request can also generate an unbounded amount of local filesystem I/O and memory pressure (the published proof of concept drives about 4.34 GB of reads), leading to denial of service. The issue is fixed in 0.15.5."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"stoatchat","product":"stoatchat","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"0.15.5","versionType":"semver","status":"affected"},{"version":"0.15.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:32:41.399938Z","id":"CVE-2026-100676","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-693"}]}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qv38-hwhv-jm49","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-local-filesystem-read-via-svg","source":"disclosure@vulncheck.com"},{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qv38-hwhv-jm49","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100677","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:51.717","lastModified":"2026-09-30T18:18:01.197","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST /api/auth/session/login requests."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"stoatchat","product":"stoatchat","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"0.15.5","versionType":"semver","status":"affected"},{"version":"0.15.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:38:01.485120Z","id":"CVE-2026-100677","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-209"}]}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h44h-xx2j-hp56","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-account-enumeration-via-error-location","source":"disclosure@vulncheck.com"},{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h44h-xx2j-hp56","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100678","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:51.857","lastModified":"2026-09-30T16:17:00.153","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"stoatchat","product":"stoatchat","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"0.15.5","versionType":"semver","status":"affected"},{"version":"0.15.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:59:59.255314Z","id":"CVE-2026-100678","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-307"}]}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-brute-force-via-insufficient-rate-limiting","source":"disclosure@vulncheck.com"},{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100679","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:51.993","lastModified":"2026-09-28T18:17:15.007","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"stoatchat","product":"stoatchat","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"0.15.5","versionType":"semver","status":"affected"},{"version":"0.15.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T18:01:30.780087Z","id":"CVE-2026-100679","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-bypass-via-cross-account-ticket","source":"disclosure@vulncheck.com"},{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100680","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:52.150","lastModified":"2026-10-08T16:16:58.253","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import endpoint to exfiltrate sensitive files including environment variables containing JWT secrets, API keys, and database credentials."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"budibase","product":"server","defaultStatus":"unaffected","packageURL":"pkg:npm/%40budibase/server","versions":[{"version":"0","lessThan":"3.45.0","versionType":"semver","status":"affected"},{"version":"3.45.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:33:38.678386Z","id":"CVE-2026-100680","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-8xr5-pggf-26jq","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/budibase-before-3.45.0-arbitrary-local-file-read-via-openapi-import","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-8xr5-pggf-26jq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100681","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:52.293","lastModified":"2026-10-08T16:16:58.410","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an attacker-controlled serviceUrl that is persisted and used for all subsequent bot replies, causing the server to send live Microsoft OAuth access tokens in Authorization headers to the attacker's host and enabling blind internal network access."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"budibase","product":"server","defaultStatus":"unaffected","packageURL":"pkg:npm/%40budibase/server","versions":[{"version":"0","lessThan":"3.45.0","versionType":"semver","status":"affected"},{"version":"3.45.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:39:21.362596Z","id":"CVE-2026-100681","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-942w-fccr-8r3c","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/budibase-before-3.45.0-ssrf-and-oauth-token-exfiltration-via-teams-webhook","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-942w-fccr-8r3c","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100682","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:52.433","lastModified":"2026-10-08T16:16:58.553","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"budibase","product":"server","defaultStatus":"unaffected","packageURL":"pkg:npm/%40budibase/server","versions":[{"version":"0","lessThan":"3.45.0","versionType":"semver","status":"affected"},{"version":"3.45.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:01:12.801469Z","id":"CVE-2026-100682","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-37r6-5jxh-vm83","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/budibase-server-before-3.45.0-arbitrary-file-write-via-zip-symlink","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-37r6-5jxh-vm83","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100683","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:52.567","lastModified":"2026-10-08T16:16:58.700","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string (backtick-quoted for MySQL, a single-quoted sp_rename literal for MSSQL) without applying the project's quoteMySqlIdentifier / quoteSqlServerIdentifier helpers. An attacker with DDL rights on a connected MySQL/MSSQL datasource can create a column whose name contains a backtick (MySQL) or single quote (MSSQL) plus additional SQL; Budibase's schema introspection stores the name verbatim, and when a Budibase builder later renames that column through the UI (POST /api/tables with _rename.old), the embedded quote character terminates the identifier and the injected SQL is executed. Because the MySQL connection is opened with multipleStatements: true, stacked statements run as Budibase's datasource user, allowing arbitrary reads, writes, or destructive operations on the connected database outside Budibase's row/table permission model. Fixed in 3.45.0."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"budibase","product":"server","defaultStatus":"unaffected","packageURL":"pkg:npm/%40budibase/server","versions":[{"version":"0","lessThan":"3.45.0","versionType":"semver","status":"affected"},{"version":"3.45.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.9,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:54:49.046964Z","id":"CVE-2026-100683","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-ppj8-hmx2-m546","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/budibase-before-3.45.0-sql-injection-via-column-rename-ddl","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-ppj8-hmx2-m546","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100684","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:52.720","lastModified":"2026-10-08T16:16:58.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validating an invite code and without an email_verified check (the email_verified gate protects only the existing-account lookup). An attacker who can register at an IdP that the tenant trusts for OIDC and assert a victim's invited email address (even with email_verified=false) claims the pending invite and inherits all of its granted privileges, including builder and admin.global, with no admin exclusion. This results in takeover of the invited principal and, for admin invites, full tenant compromise (access to all apps, datasources including production credentials, and automations); the invite is consumed, denying onboarding to the legitimate invitee."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"budibase","product":"server","defaultStatus":"unaffected","packageURL":"pkg:npm/%40budibase/server","versions":[{"version":"3.41.0","lessThan":"3.45.0","versionType":"semver","status":"affected"},{"version":"3.45.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:36:13.282180Z","id":"CVE-2026-100684","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-35ch-57g2-3g98","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/budibase-server-3.41.0-before-3.45.0-authentication-bypass-via-oidc","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-35ch-57g2-3g98","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100685","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:52.860","lastModified":"2026-10-08T16:16:58.993","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data including user IDs and external chat service identifiers from other workspaces they have no permission to access."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"budibase","product":"server","defaultStatus":"unaffected","packageURL":"pkg:npm/%40budibase/server","versions":[{"version":"0","lessThan":"3.45.0","versionType":"semver","status":"affected"},{"version":"3.45.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:08:53.182409Z","id":"CVE-2026-100685","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-76m3-47v8-p7h6","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/budibase-before-3.45.0-information-disclosure-via-chat-links","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-76m3-47v8-p7h6","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100686","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:53.000","lastModified":"2026-10-08T16:16:59.130","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"budibase","product":"server","defaultStatus":"unaffected","packageURL":"pkg:npm/%40budibase/server","versions":[{"version":"0","lessThan":"3.45.0","versionType":"semver","status":"affected"},{"version":"3.45.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:02:51.742533Z","id":"CVE-2026-100686","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-pp5r-q4fp-mcj3","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/budibase-before-3.45.0-cross-workspace-privilege-escalation-via-post-api-global-groups-groupid-apps","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-pp5r-q4fp-mcj3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100687","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:53.140","lastModified":"2026-10-08T16:16:59.270","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing table save or delete operations."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"budibase","product":"server","defaultStatus":"unaffected","packageURL":"pkg:npm/%40budibase/server","versions":[{"version":"0","lessThan":"3.45.0","versionType":"semver","status":"affected"},{"version":"3.45.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:52:31.727952Z","id":"CVE-2026-100687","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-rmv5-3xpj-w885","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/budibase-server-before-3.45.0-credential-exposure-via-external-table-broadcast","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100688","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:53.280","lastModified":"2026-10-08T16:16:59.417","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrieve sensitive application details including navigation structure, role names, internal screen URLs, JavaScript snippets, and user identifiers without authorization checks."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"budibase","product":"server","defaultStatus":"unaffected","packageURL":"pkg:npm/%40budibase/server","versions":[{"version":"0","lessThan":"3.45.0","versionType":"semver","status":"affected"},{"version":"3.45.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:37:05.955451Z","id":"CVE-2026-100688","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-4946-qf2m-wrh5","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/budibase-server-before-3.45.0-cross-tenant-information-disclosure","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-4946-qf2m-wrh5","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100689","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:53.420","lastModified":"2026-09-30T18:18:01.610","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the `name` field, and GitPython's own containment guard Submodule._to_relative_path() is applied in add() and move(), Submodule.update() derives the absolute checkout location from the raw `path` value without that guard. A .gitmodules entry containing directory traversal components (e.g., path = ../../../tmp/escaped) can therefore cause directories to be created via os.makedirs() outside the repository working tree, populated from the submodule URL on the clone path, and removed via shutil.rmtree() when force_remove is used. Exploitation requires an application flow that updates submodules at a non-HEAD commit (such as a historical-commit API); the common clone-then-update flow re-derives the path from a canonical tree lookup and is not affected. The issue is fixed in GitPython 3.1.62."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"gitpython-developers","product":"GitPython","defaultStatus":"unaffected","packageURL":"pkg:pypi/GitPython","versions":[{"version":"0","lessThan":"3.1.62","versionType":"semver","status":"affected"},{"version":"3.1.62","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:41:00.466396Z","id":"CVE-2026-100689","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-59cr-6r3x-644w","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.62-path-traversal-via-gitmodules-path","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100690","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:53.560","lastModified":"2026-09-30T16:17:00.597","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"gohugoio","product":"hugo","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/gohugoio/hugo","versions":[{"version":"0.161.0","lessThan":"0.166.0","versionType":"semver","status":"affected"},{"version":"0.166.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:04:21.434495Z","id":"CVE-2026-100690","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*","versionStartIncluding":"0.161.0","versionEndExcluding":"0.166.0","matchCriteriaId":"D90D87C3-3FC1-44DF-96FC-8D905E47B13A"}]}]}],"references":[{"url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-x3mx-cm49-8m9c","source":"disclosure@vulncheck.com","tags":["Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/hugo-0.161.0-to-0.165.0-arbitrary-file-read-via-symlinks","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-100691","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:53.710","lastModified":"2026-09-29T19:08:14.347","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value supplied as a Markdown code fence attribute (or passed to the `highlight` template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo's security model otherwise considers content trusted input. Fixed in 0.166.0, where the `lineAnchors` value is HTML-escaped before being passed to Chroma."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"gohugoio","product":"hugo","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/gohugoio/hugo","versions":[{"version":"0.75.0","lessThan":"0.166.0","versionType":"semver","status":"affected"},{"version":"0.166.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:51:21.843171Z","id":"CVE-2026-100691","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*","versionStartIncluding":"0.75.0","versionEndExcluding":"0.166.0","matchCriteriaId":"C44835BA-BC4C-4679-B6E3-D7BAA532E136"}]}]}],"references":[{"url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-q4xf-287f-98r8","source":"disclosure@vulncheck.com","tags":["Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/hugo-before-0.166.0-stored-xss-via-lineanchors-code-block-option","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-100692","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:53.860","lastModified":"2026-09-29T19:08:03.413","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -> /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"gohugoio","product":"hugo","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/gohugoio/hugo","versions":[{"version":"0","lessThan":"0.166.0","versionType":"semver","status":"affected"},{"version":"0.166.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:30:07.157360Z","id":"CVE-2026-100692","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*","versionStartIncluding":"0.123.0","versionEndExcluding":"0.166.0","matchCriteriaId":"81C30C3C-EF48-4CD9-85BC-021F48B1E58D"}]}]}],"references":[{"url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-797m-7j5g-3rpr","source":"disclosure@vulncheck.com","tags":["Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/hugo-before-0.166.0-path-traversal-via-symlinked-mount-roots","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-100693","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:54.007","lastModified":"2026-09-30T18:18:01.750","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"gohugoio","product":"hugo","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/gohugoio/hugo","versions":[{"version":"0.162.0","lessThan":"0.166.0","versionType":"semver","status":"affected"},{"version":"0.166.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:05:19.378001Z","id":"CVE-2026-100693","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-178"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*","versionStartIncluding":"0.162.0","versionEndExcluding":"0.166.0","matchCriteriaId":"0C56BFB3-7485-41FB-A100-3CA7E641B56F"}]}]}],"references":[{"url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-pmrv-x7gp-2rjw","source":"disclosure@vulncheck.com","tags":["Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/hugo-0.162.0-before-0.166.0-ip-literal-deny-rule-bypass","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-100694","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:54.150","lastModified":"2026-09-30T16:17:00.753","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting (XSS) in the generated site. An attacker who can supply or influence a content file under /content or the output of a content adapter can inject scripts that execute in the browsers of visitors to the affected pages. Only pages whose source file or content-adapter output declares the text/org media type are affected, and sites that fully trust all content sources are not impacted. Version v0.166.0 fixes the issue by introducing a security.allowContent allowlist that denies text/org by default; sites that intentionally author Org Mode content can opt back in with [security] allowContent = ['.*']."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"gohugoio","product":"hugo","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/gohugoio/hugo","versions":[{"version":"0.56.0","lessThan":"0.166.0","versionType":"semver","status":"affected"},{"version":"0.166.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:05:06.488369Z","id":"CVE-2026-100694","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*","versionStartIncluding":"0.56.0","versionEndExcluding":"0.166.0","matchCriteriaId":"AAC4EDBF-1368-4FCA-A49B-426AD1A918AD"}]}]}],"references":[{"url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-pq74-mj4h-cjq2","source":"disclosure@vulncheck.com","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/hugo-before-0.166.0-cross-site-scripting-via-text-org","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-100695","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:54.297","lastModified":"2026-09-28T18:17:15.590","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments where the database has FILE privileges and can write to the webroot, attackers can use the XSS to submit authenticated SQL requests that write PHP files via INTO DUMPFILE, achieving remote code execution as the web server account."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"vrana","product":"adminer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.0.2","versionType":"semver","status":"affected"},{"version":"6.0.2","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:44:23.167502Z","id":"CVE-2026-100695","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-7c5h-q78c-fpxx","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/adminer-before-6.0.2-xss-via-connection-id-escalating-to-rce","source":"disclosure@vulncheck.com"},{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-7c5h-q78c-fpxx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100696","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:54.437","lastModified":"2026-09-28T17:17:45.537","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.php), fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect() before the login result is validated, an unauthenticated attacker who submits crafted auth[server], auth[username], and auth[password] parameters can cause the Adminer server to issue an HTTP GET request (via get_url()/file_get_contents()) to an arbitrary reachable host and port. The driver validates only general server syntax and does not block loopback, private, link-local, or other reserved addresses; if no port is given it appends the default 9200, and Adminer's generic port check rejects ports below 1024. Selected JSON error fields from non-2xx Elasticsearch-style responses, as well as connection failures, are rendered on the login page, providing a port-scanning oracle and enabling internal network reconnaissance and service fingerprinting. Exploitation requires that the optional Elasticsearch driver be explicitly deployed (e.g., via the adminer/elastic.php template or an adminer_object() configuration; it is not loaded in a default build) and that PHP allow_url_fopen be enabled."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"vrana","product":"adminer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.0.2","versionType":"semver","status":"affected"},{"version":"6.0.2","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:28:12.462409Z","id":"CVE-2026-100696","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-q8h3-4cx4-prgm","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/adminer-before-6.0.2-unauthenticated-ssrf-via-elasticsearch-driver","source":"disclosure@vulncheck.com"},{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-q8h3-4cx4-prgm","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100697","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:54.583","lastModified":"2026-09-30T18:18:01.890","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST containing 'SELECT version()' to that host. In rootQuery(), if the target returns a status outside 200-299 (other than 401/403), the raw HTTP response body is assigned to the connection error and rendered on the login page, so the attacker receives the full response body of the internal service. This enables internal network/port reconnaissance and disclosure of sensitive information contained in internal error pages (stack traces, internal hostnames, file paths, configuration identifiers). Fixed in Adminer 6.0.2."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"vrana","product":"adminer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.0.2","versionType":"semver","status":"affected"},{"version":"6.0.2","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:43:41.148058Z","id":"CVE-2026-100697","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-77qq-q8fv-x45v","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/adminer-6.0.0-server-side-request-forgery-via-clickhouse-driver","source":"disclosure@vulncheck.com"},{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-77qq-q8fv-x45v","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100698","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:54.730","lastModified":"2026-09-30T16:17:00.913","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returning the whole string as the host with an empty port. Because the privileged-port restriction in adminer/include/auth.inc.php inspects only the parsed port, the check is skipped, and the mysqli/mysqlnd client subsequently re-parses host:port from the host string and opens a TCP connection. A remote, unauthenticated attacker who can reach the Adminer login page can submit a crafted value such as 127.0.0.1:80/x to make the server initiate TCP connections to arbitrary internal hosts and privileged ports before credentials are validated, enabling server-side request forgery and blind internal port scanning (connection refused vs. handshake vs. timeout acts as a liveness oracle). This is a regression that re-opens the bypass fixed in 5.5.0 (GHSA-58cq-mgw2-38m5). Fixed in 6.0.2."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"vrana","product":"adminer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.0.2","versionType":"semver","status":"affected"},{"version":"6.0.2","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:07:29.504241Z","id":"CVE-2026-100698","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-rwxg-xph9-82cj","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/adminer-before-6.0.2-privileged-port-ssrf-via-host-port-regex","source":"disclosure@vulncheck.com"},{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-rwxg-xph9-82cj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100699","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:54.867","lastModified":"2026-09-30T16:32:17.940","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input \"user\"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node), so a malformed/ambiguous recipient address can be accepted and placed in the SMTP envelope. Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. The issue is a variant of the RFC 5322 comment parsing problem addressed in GHSA-cc9r-2j5m-2m83, affecting the separate quoted-local-part code path. Version 10.0.9 contains a fix."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"nodemailer","product":"nodemailer","defaultStatus":"unaffected","packageURL":"pkg:npm/nodemailer","versions":[{"version":"9.1.0","lessThan":"10.0.9","versionType":"semver","status":"affected"},{"version":"10.0.9","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:42:55.592537Z","id":"CVE-2026-100699","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/nodemailer-before-10.0.9-malformed-envelope-recipient-via-rfc-5322-comment","source":"disclosure@vulncheck.com"},{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100700","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:55.007","lastModified":"2026-09-30T16:32:17.940","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"nodemailer","product":"nodemailer","defaultStatus":"unaffected","packageURL":"pkg:npm/nodemailer","versions":[{"version":"0","lessThan":"10.0.6","versionType":"semver","status":"affected"},{"version":"10.0.6","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T15:00:18.660649Z","id":"CVE-2026-100700","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-407"}]}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/nodemailer-before-10.0.6-denial-of-service-via-addressparser","source":"disclosure@vulncheck.com"},{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100701","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:55.143","lastModified":"2026-09-30T16:32:17.940","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on the cache hit and overwrites the second transport's explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport to connect to the attacker's TLS virtual host and accept the attacker's certificate even with rejectUnauthorized: true, disclosing the victim's SMTP credentials. Fixed in 10.0.2."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"nodemailer","product":"nodemailer","defaultStatus":"unaffected","packageURL":"pkg:npm/nodemailer","versions":[{"version":"5.0.0","lessThan":"10.0.2","versionType":"semver","status":"affected"},{"version":"10.0.2","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:11:29.663446Z","id":"CVE-2026-100701","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/nodemailer-5.0.0-through-10.0.1-tls-servername-cache-confusion","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100702","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:55.280","lastModified":"2026-09-30T16:32:17.940","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"nodemailer","product":"nodemailer","defaultStatus":"unaffected","packageURL":"pkg:npm/nodemailer","versions":[{"version":"0","lessThan":"10.0.2","versionType":"semver","status":"affected"},{"version":"10.0.2","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:11:09.180121Z","id":"CVE-2026-100702","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/nodemailer-before-10.0.2-stack-exhaustion-via-nested-recipient-arrays","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100703","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:55.420","lastModified":"2026-09-28T18:17:15.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries (resource.Lib, http.Lib, configMap loader) which are handed the policy namespace. A tenant who can create a namespaced policy (e.g. NamespacedValidatingPolicy, and likewise the namespaced mutating, deleting, generating, and image-validating policy kinds) in their own namespace can call globalContext.get(\"<entry>\", \"\") and receive the full cached contents of a cluster-scoped GlobalContextEntry, including data cached from namespaces the tenant has no RBAC permission to read. No admission validation rejects such calls. Fixed in 1.19.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"kyverno","product":"kyverno","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/kyverno/kyverno","versions":[{"version":"1.16.0","lessThan":"1.19.1","versionType":"semver","status":"affected"},{"version":"1.19.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:42:01.709434Z","id":"CVE-2026-100703","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-59v6-2x73-wfg4","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/kyverno-before-1.19.1-cross-namespace-data-access-via-globalcontext-lib","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100704","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:55.563","lastModified":"2026-09-30T17:23:08.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource causes image signature verification to be skipped for the entire resource rather than only for the listed images or values, so an exception intended to exempt a single trusted image exempts every image on the matched resource(s). As a result, unsigned or untrusted images can be admitted to the cluster without signature verification. This differs from ValidatingPolicy, GeneratingPolicy, and MutatingPolicy, which treat the same field as a partial exemption. The issue is fixed in version 1.19.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"kyverno","product":"kyverno","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/kyverno/kyverno","versions":[{"version":"1.14.0","lessThan":"1.19.1","versionType":"semver","status":"affected"},{"version":"1.19.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:50:12.818189Z","id":"CVE-2026-100704","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-5cjf-wwfg-pj4c","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/kyverno-before-1.19.1-imagevalidatingpolicy-exception-bypass","source":"disclosure@vulncheck.com"},{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-5cjf-wwfg-pj4c","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100705","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:55.703","lastModified":"2026-09-28T15:20:06.633","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128) and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legacy apiCall service executor (pkg/engine/apicall/executor.go) or to the GlobalContextEntry external-API path, which handle every non-CEL context[].apiCall.service call. Because these paths use a plain net/http client with no egress filtering and no validation of the configured service URL, a ClusterPolicy or GlobalContextEntry author — or, where a deployed policy templates the service URL from the admission resource, a lower-privileged resource submitter — can cause Kyverno to issue GET/POST requests to an arbitrary host, including the cloud metadata endpoint, loopback, and any in-cluster service, reading cloud instance credentials and reaching internal endpoints with Kyverno's network position. The executor also unconditionally attaches Kyverno's projected ServiceAccount token to the attacker-chosen destination; the token is audience-scoped, limiting its replay value. Fixed in 1.19.1."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"kyverno","product":"kyverno","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/kyverno/kyverno","versions":[{"version":"0","lessThan":"1.19.1","versionType":"semver","status":"affected"},{"version":"1.19.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:10:38.587553Z","id":"CVE-2026-100705","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-q825-p383-r9v5","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/kyverno-before-1.19.1-ssrf-via-legacy-apicall-service-executor","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100706","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:55.843","lastModified":"2026-09-28T15:20:06.633","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal sequences to create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, enabling privilege escalation to cluster admin."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"kyverno","product":"kyverno","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/kyverno/kyverno","versions":[{"version":"0","lessThan":"1.19.1","versionType":"semver","status":"affected"},{"version":"1.19.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:08:47.920272Z","id":"CVE-2026-100706","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"references":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-5qq8-67g6-4h2w","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/kyverno-before-1.19.1-privilege-escalation-via-policy-apicall-urlpath","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100707","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:55.983","lastModified":"2026-09-28T18:17:16.030","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and read resources from other namespaces using the Kyverno admission controller's ServiceAccount credentials."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"kyverno","product":"kyverno","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/kyverno/kyverno","versions":[{"version":"0","lessThan":"1.19.1","versionType":"semver","status":"affected"},{"version":"1.19.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:40:59.702394Z","id":"CVE-2026-100707","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-c5qq-7g2q-cpqp","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/kyverno-before-1.19.1-namespace-isolation-bypass-via-percent-encoded-path","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100708","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:56.153","lastModified":"2026-09-28T15:17:11.077","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domain_ssl_settings queries are passed through ApiCommand::response() without any field stripping or allowlist. A low-privileged authenticated customer API caller can retrieve the private keys of their own domains' certificates, including Let's Encrypt keys that Froxlor generates server-side and stores root-only (0600) and to which the customer otherwise has no filesystem access; reseller and customers_see_all admin accounts can dump the private keys of other principals through the same sink. Disclosed keys enable domain impersonation, passive decryption of captured TLS traffic, and active machine-in-the-middle attacks."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"froxlor","product":"froxlor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.13","versionType":"semver","status":"affected"},{"version":"2.3.13","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:49:25.749351Z","id":"CVE-2026-100708","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-6q2v-jjq5-m2c8","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.13-private-key-disclosure-via-certificates-api","source":"disclosure@vulncheck.com"},{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-6q2v-jjq5-m2c8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100709","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:56.417","lastModified":"2026-09-26T23:16:32.930","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated from separate namespaces, a remembered-2FA token legitimately issued to a customer with a given ID also matches an administrator with the same ID. An attacker who controls a customer account with a colliding ID, holds a valid remembered-2FA cookie for it, and already knows the target administrator's password can bypass the administrator's TOTP second factor and obtain an authenticated administrator session. This is a second-factor bypass only; it does not defeat password authentication. Fixed in 2.3.12."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"froxlor","product":"froxlor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.12","versionType":"semver","status":"affected"},{"version":"2.3.12","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:08:11.816656Z","id":"CVE-2026-100709","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-9fq7-9w8p-c3qh","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.12-2fa-bypass-via-namespace-confusion","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100710","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:56.580","lastModified":"2026-09-26T23:16:33.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() perform a wildcard SELECT over the panel_domains table and return the row unmodified, including the panel_domains.dkim_privkey field. An authenticated, non-superadmin admin holding the delegated customers_see_all flag can therefore read the DKIM private signing keys of domains belonging to other tenants via Domains.get, Domains.listing, SubDomains.get, or SubDomains.listing, with a single listing call disclosing the key of every visible domain. The disclosed keys allow an attacker to sign email that passes DKIM verification and DMARC alignment for the affected domains. This is a follow-on to an incomplete fix that stripped password and data_2fa but not dkim_privkey. The issue is fixed in 2.3.12."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"froxlor","product":"froxlor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.12","versionType":"semver","status":"affected"},{"version":"2.3.12","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:07:46.284163Z","id":"CVE-2026-100710","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-79gx-h528-j9xf","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.12-dkim-private-key-disclosure-via-api","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100711","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:56.743","lastModified":"2026-09-28T17:17:45.767","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response actions."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"froxlor","product":"froxlor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.12","versionType":"semver","status":"affected"},{"version":"2.3.12","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:01:53.131379Z","id":"CVE-2026-100711","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-57wv-g7m3-hmff","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.12-authentication-bypass-via-session-persistence","source":"disclosure@vulncheck.com"},{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-57wv-g7m3-hmff","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100712","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:56.903","lastModified":"2026-09-28T15:17:11.253","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g. /customer_index.php?page=2fa&action=delete), with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers POST/PUT/PATCH/DELETE requests, and the session cookie is set to SameSite=Lax, so a cross-site top-level navigation (link click or redirect) carries the victim's session and silently clears type_2fa/data_2fa. Both the customer and admin 2FA handlers are affected. An attacker who lures a logged-in panel user into following a crafted link reduces that account to password-only authentication, which can be chained with a compromised password for account takeover. Fixed in 2.3.12."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"froxlor","product":"froxlor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.12","versionType":"semver","status":"affected"},{"version":"2.3.12","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:44:25.796627Z","id":"CVE-2026-100712","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-w582-7wqv-62mm","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.12-two-factor-authentication-bypass-via-csrf","source":"disclosure@vulncheck.com"},{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-w582-7wqv-62mm","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100713","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:57.067","lastModified":"2026-09-26T23:16:33.173","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles). The containment/symlink validation performed by FileDir::makeCorrectDir()/makeCorrectFile() is done only at check time; the live filesystem path is re-resolved as root at write time (file_put_contents with FILE_APPEND|LOCK_EX, followed by chmod/chown/chgrp), with a database round-trip and file reads in between, and no path or file-descriptor pinning (no O_NOFOLLOW or openat2(RESOLVE_NO_SYMLINKS)). On installations where the non-default setting system.allow_customer_shell=1 grants customers local shell access, a customer can atomically swap their ~/.ssh directory for a symlink after the check and before the write, causing the root-run cron to append the customer's public key to /root/.ssh/authorized_keys and to chown /root/.ssh to the customer, resulting in full root compromise of the panel host. The cron re-runs on every interval, allowing unlimited attempts. This is a residual race that bypasses the check-time fix introduced for GHSA-mq5v-... . The issue is fixed in Froxlor 2.3.12."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"froxlor","product":"froxlor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.12","versionType":"semver","status":"affected"},{"version":"2.3.12","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:10:07.764073Z","id":"CVE-2026-100713","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-927x-9jfh-mq42","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.12-privilege-escalation-via-ssh-key-sync","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100714","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:57.240","lastModified":"2026-09-26T23:16:33.297","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no string_regexp or required_otp guard, and its value is concatenated unescaped into the acme.sh command line built in lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php and executed by the root cron via FileDir::safe_exec. Because safe_exec only blacklists shell metacharacters such as ; | & > < \\ $ ~ ?, spaces and quotes survive and the value is word-split into additional acme.sh arguments. An administrator, or any actor able to write settings (for example through the settings-import API), can therefore inject acme.sh options such as --renew-hook, --pre-hook or --post-hook to obtain arbitrary command execution as root at the next Let's Encrypt cron run, or use --config-home/--cert-home for arbitrary file writes. Versions up to and including 2.3.10 are affected; the issue is fixed in 2.3.12."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"froxlor","product":"froxlor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.12","versionType":"semver","status":"affected"},{"version":"2.3.12","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:07:23.597548Z","id":"CVE-2026-100714","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-3w4g-cmpj-rj42","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.12-command-injection-via-letsencryptchallengepath","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100715","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:57.427","lastModified":"2026-09-28T17:17:45.913","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued when an FTP account is deleted, calls FileDir::makeCorrectDir() without the $fixed_homedir argument, so the symlink component walk is skipped, and then executes 'rm -rf' as root on the resulting path with string-level guards only. Because makeCorrectDir() appends a trailing slash, GNU rm dereferences a symlink used either as an intermediate path component or as the final component. An authenticated customer who can write to the FTP home directory can plant a symlink between task insertion and cron execution, causing the root cron job to recursively delete arbitrary directory trees, resulting in cross-tenant data destruction and host denial of service. This issue is fixed in Froxlor 2.3.12."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"froxlor","product":"froxlor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.12","versionType":"semver","status":"affected"},{"version":"2.3.12","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:56:45.496100Z","id":"CVE-2026-100715","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-px4q-2rf7-cvcf","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.12-arbitrary-file-deletion-via-symlink","source":"disclosure@vulncheck.com"},{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-px4q-2rf7-cvcf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100716","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:57.583","lastModified":"2026-09-28T15:17:11.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path components of the export destination: Froxlor\\FileDir::makeCorrectDir() contains an off-by-one in its path-component walk that skips the first segment below the customer home directory, and the guard in ExportCron.php checks only the final component with is_link(). An authenticated customer whose account has the export feature enabled can schedule an export into a genuine subdirectory of their own webspace, then replace an intermediate path component with a symlink before the root-owned cron runs. The cron's `chown -R` then recursively changes ownership of the linked directory tree — for example /etc — to the customer's UID, yielding host root and cross-tenant compromise. Exploitation is deterministic and requires no race. This is an incomplete fix of GHSA-75h4-... The issue is fixed in Froxlor 2.3.12."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"froxlor","product":"froxlor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.12","versionType":"semver","status":"affected"},{"version":"2.3.12","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:40:34.238165Z","id":"CVE-2026-100716","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-2wjc-6mgx-hq42","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.12-privilege-escalation-via-symlink","source":"disclosure@vulncheck.com"},{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-2wjc-6mgx-hq42","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100717","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:57.753","lastModified":"2026-09-30T18:18:02.033","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parse_url, and never inspects the userinfo (user:pass@) components. This is an incomplete fix for GHSA-c3p2. An authenticated low-privilege customer with subdomain-create rights (no admin or change_serversettings privilege required) can supply a subdomain redirect URL that carries a CR/LF payload in the userinfo portion (e.g. http://user%0areturn 200 \"pwned\";%0a@evil.com/). The value passes validation, survives IDNA encoding, and is written verbatim into the generated nginx or Apache vhost configuration, allowing the attacker to break out of the emitted directive and inject arbitrary web-server configuration lines. froxlor regenerates and reloads the web-server configuration as root, so the injected directives take effect server-wide and can hijack responses or read local files. The issue is fixed in version 2.3.12."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"froxlor","product":"froxlor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.12","versionType":"semver","status":"affected"},{"version":"2.3.12","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:07:07.860788Z","id":"CVE-2026-100717","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-93"}]}],"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-gxx3-hwjc-h2gp","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.12-crlf-injection-via-validateurl-userinfo","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100718","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:57.917","lastModified":"2026-09-26T23:16:33.417","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains (mail.enable_allow_sender = 1, mail.allow_external_domains = 0), an authenticated customer with API access can still use EmailSender.add to register an arbitrary external sender address for their mailbox, which is stored despite the policy. This creates a bypass between the UI/administrator configuration and the API, and — where the generated mail configuration consumes the allowed-sender table — allows a customer to authorize sender identities outside their hosted domains, facilitating sender spoofing. Fixed in 2.3.12."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"froxlor","product":"froxlor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.12","versionType":"semver","status":"affected"},{"version":"2.3.12","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:06:54.103708Z","id":"CVE-2026-100718","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-276"}]}],"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-m9j6-9856-68xf","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.12-authentication-bypass-via-emailsender-add","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100719","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:58.077","lastModified":"2026-09-26T23:16:33.543","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure of reused credentials."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"froxlor","product":"froxlor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.12","versionType":"semver","status":"affected"},{"version":"2.3.12","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:02:41.111630Z","id":"CVE-2026-100719","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-8wfc-9qp5-gjxf","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.12-credential-disclosure-via-dirprotections-api","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-100720","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-26T14:16:58.230","lastModified":"2026-09-26T23:16:33.660","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one of their own domains, the Certificates API add()/update() methods parse it with openssl_x509_parse() and store the issuer organization (issuer['O']) value verbatim without sanitization. Froxlor's table-listing renderer then emits scalar cells through Twig's `raw` filter, disabling HTML auto-escaping, so when an administrator or reseller opens Domains > SSL certificates the attacker-supplied issuer value executes as script in the privileged user's session. This crosses a privilege boundary from customer to admin and can result in full administrator account takeover; because a Froxlor admin controls webserver, DNS, and PHP configuration applied by a cron job running as root, the issue can be further escalated to command execution as root on the managed server. The issue is fixed in Froxlor 2.3.12."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"froxlor","product":"froxlor","defaultStatus":"unaffected","versions":[{"version":"2.0.0","lessThan":"2.3.12","versionType":"semver","status":"affected"},{"version":"2.3.12","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:02:16.405840Z","id":"CVE-2026-100720","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-89vj-gqqr-73p8","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.12-stored-xss-via-ssl-certificate-issuer","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-94130","sourceIdentifier":"security@joomla.org","published":"2026-09-26T14:17:00.880","lastModified":"2026-10-15T13:49:22.587","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An SQL injection vulnerability in video search functionality and sorting allowed attackers to inject SQL commands in read queries."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"joomlaboat.com","product":"YouTube Gallery extension for Joomla","defaultStatus":"unaffected","versions":[{"version":"1.0.0-5.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:58:28.777566Z","id":"CVE-2026-94130","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:joomlaboat:youtube_gallery:*:*:*:*:*:joomla\\!:*:*","versionEndExcluding":"5.7.3","matchCriteriaId":"628302FC-AC90-4EE0-9F01-DAD7489496F2"}]}]}],"references":[{"url":"https://joomlaboat.com/youtube-gallery","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-94131","sourceIdentifier":"security@joomla.org","published":"2026-09-26T15:16:54.183","lastModified":"2026-10-20T20:28:10.017","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"acymailing.com","product":"AcyMailing extension for Joomla","defaultStatus":"unaffected","versions":[{"version":"6.0.0-11.0.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:57:46.440866Z","id":"CVE-2026-94131","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:enterprise:joomla\\!:*:*","versionEndExcluding":"11.1.0","matchCriteriaId":"A67E95C5-E715-4DB4-8822-FEDE63FFC384"}]}]}],"references":[{"url":"https://www.acymailing.com/","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-94132","sourceIdentifier":"security@joomla.org","published":"2026-09-26T15:16:55.397","lastModified":"2026-10-20T20:25:58.700","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PHP file into the web root."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"acymailing.com","product":"AcyMailing Enterprise extension for Joomla","defaultStatus":"unaffected","versions":[{"version":"6.0.0-11.0.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.5,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:58:09.127032Z","id":"CVE-2026-94132","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:enterprise:joomla\\!:*:*","versionEndExcluding":"11.1.0","matchCriteriaId":"A67E95C5-E715-4DB4-8822-FEDE63FFC384"}]}]}],"references":[{"url":"https://www.acymailing.com/","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-97160","sourceIdentifier":"security@joomla.org","published":"2026-09-26T15:16:55.520","lastModified":"2026-10-20T20:19:49.483","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29"}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"lomart.fr","product":"UP plugin for Joomla","defaultStatus":"unaffected","versions":[{"version":"5.0.0-5.2.0","status":"affected"},{"version":"6.0.0-6.0.29","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:57:25.532140Z","id":"CVE-2026-97160","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lomart:up:*:*:*:*:*:joomla\\!:*:*","versionStartIncluding":"5.0.0","versionEndIncluding":"5.2.0","matchCriteriaId":"A246DB34-70A6-406F-8927-DA7E166F0E60"},{"vulnerable":true,"criteria":"cpe:2.3:a:lomart:up:*:*:*:*:*:joomla\\!:*:*","versionStartIncluding":"6.0.0","versionEndIncluding":"6.0.29","matchCriteriaId":"199C1A7F-69EF-4ACD-8BFD-D03FD329572B"}]}]}],"references":[{"url":"https://up.lomart.fr/","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-97161","sourceIdentifier":"security@joomla.org","published":"2026-09-26T15:16:55.640","lastModified":"2026-10-20T20:17:48.057","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29"}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"lomart.fr","product":"UP plugin for Joomla","defaultStatus":"unaffected","versions":[{"version":"5.0.0-5.2.0","status":"affected"},{"version":"6.0.0-6.0.29","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:56:22.967007Z","id":"CVE-2026-97161","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lomart:up:*:*:*:*:*:joomla\\!:*:*","versionStartIncluding":"5.0.0","versionEndIncluding":"5.2.0","matchCriteriaId":"A246DB34-70A6-406F-8927-DA7E166F0E60"},{"vulnerable":true,"criteria":"cpe:2.3:a:lomart:up:*:*:*:*:*:joomla\\!:*:*","versionStartIncluding":"6.0.0","versionEndIncluding":"6.0.29","matchCriteriaId":"199C1A7F-69EF-4ACD-8BFD-D03FD329572B"}]}]}],"references":[{"url":"https://up.lomart.fr/","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-97162","sourceIdentifier":"security@joomla.org","published":"2026-09-26T15:16:55.767","lastModified":"2026-10-20T20:15:31.377","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29"}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"lomart.fr","product":"UP plugin for Joomla","defaultStatus":"unaffected","versions":[{"version":"5.0.0-5.2.0","status":"affected"},{"version":"6.0.0-6.0.29","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:57:05.689504Z","id":"CVE-2026-97162","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lomart:up:*:*:*:*:*:joomla\\!:*:*","versionStartIncluding":"5.0.0","versionEndIncluding":"5.2.0","matchCriteriaId":"A246DB34-70A6-406F-8927-DA7E166F0E60"},{"vulnerable":true,"criteria":"cpe:2.3:a:lomart:up:*:*:*:*:*:joomla\\!:*:*","versionStartIncluding":"6.0.0","versionEndIncluding":"6.0.29","matchCriteriaId":"199C1A7F-69EF-4ACD-8BFD-D03FD329572B"}]}]}],"references":[{"url":"https://up.lomart.fr/","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-97163","sourceIdentifier":"security@joomla.org","published":"2026-09-26T15:16:55.890","lastModified":"2026-10-20T20:09:45.320","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29"}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"lomart.fr","product":"UP plugin for Joomla","defaultStatus":"unaffected","versions":[{"version":"5.0.0-5.2.0","status":"affected"},{"version":"6.0.0-6.0.29","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:56:42.633277Z","id":"CVE-2026-97163","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lomart:up:*:*:*:*:*:joomla\\!:*:*","versionStartIncluding":"5.0.0","versionEndIncluding":"5.2.0","matchCriteriaId":"A246DB34-70A6-406F-8927-DA7E166F0E60"},{"vulnerable":true,"criteria":"cpe:2.3:a:lomart:up:*:*:*:*:*:joomla\\!:*:*","versionStartIncluding":"6.0.0","versionEndIncluding":"6.0.29","matchCriteriaId":"199C1A7F-69EF-4ACD-8BFD-D03FD329572B"}]}]}],"references":[{"url":"https://up.lomart.fr/","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-77203","sourceIdentifier":"security@wordfence.com","published":"2026-09-26T18:16:29.917","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groups_join() function deriving group-join eligibility from the ambient post's author capabilities via the global $post->post_author rather than from the currently authenticated user's own capabilities, while simultaneously minting and returning a valid groups-join-data hash and WordPress nonce for the caller in the same response — eliminating all authorization barriers to self-enrollment. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enroll themselves into any group including privileged groups carrying the groups_admin_groups capability, and to subsequently create and join a group containing every registered WordPress capability, effectively escalating their privileges to Administrator. Exploitation requires the attacker to supply an Administrator-authored post ID via the post_ID parameter of the authenticated wp_ajax_parse_media_shortcode handler in order to establish the privileged ambient post context used by the flawed authorization check."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"itthinx","product":"Groups – Memberships and Access Control","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.6.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:44:23.567859Z","id":"CVE-2026-77203","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/groups/tags/4.5.0/lib/views/class-groups-shortcodes.php#L463","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/groups/tags/4.5.0/lib/views/class-groups-shortcodes.php#L521","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/groups/tags/4.5.0/lib/views/class-groups-shortcodes.php#L586","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/groups/tags/4.5.0/lib/views/class-groups-shortcodes.php#L624","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/groups/tags/4.5.0/lib/wp/class-groups-wordpress.php#L248","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3693123/groups","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e86dddc9-c1d3-426b-8ec7-2e56dc3c2379?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-85984","sourceIdentifier":"security@wordfence.com","published":"2026-09-26T18:16:31.010","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log in as any existing administrator account by supplying only a known username and an empty password alongside mo_wp_login_intent=otp, with no password or OTP verification required. Exploitation is conditional on a site administrator having simultaneously enabled the following plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"cyberlord92","product":"miniOrange OTP Login, Verification and SMS Notifications","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.5.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:44:09.022623Z","id":"CVE-2026-85984","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.5/includes/js/loginform.js#L176","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.5/views/forms/mowploginform.php#L134","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3687601/miniorange-otp-verification","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2895f0c2-41b6-4b11-9865-3bded4402aa9?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-82901","sourceIdentifier":"security@wordfence.com","published":"2026-09-26T19:16:28.427","lastModified":"2026-09-28T15:16:04.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: This is only exploitable when the plugin's PDF Generator module is enabled, which is disabled by default."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"themefic","product":"Ultra Addons for Contact Form 7","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.5.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:44:38.206067Z","id":"CVE-2026-82901","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.48/addons/pdf-generator/pdf-generator.php#L608","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.48/addons/pdf-generator/pdf-generator.php#L807","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.48/addons/signature/ultimate-signature.php#L133","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.48/addons/signature/ultimate-signature.php#L192","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.48/addons/signature/ultimate-signature.php#L300","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3698232/ultimate-addons-for-contact-form-7","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/872e1a05-aacc-44fa-93c1-8c3f7b2fb46d?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-72662","sourceIdentifier":"security@elastic.co","published":"2026-09-26T21:16:55.410","lastModified":"2026-09-28T16:31:47.727","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Kibana","defaultStatus":"unaffected","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.21","versionType":"semver","status":"affected"},{"version":"9.4.0","lessThanOrEqual":"9.4.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:01:25.142449Z","id":"CVE-2026-72662","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://discuss.elastic.co/t/kibana-8-19-22-9-4-6-security-update-esa-2026-103/390679","source":"security@elastic.co"}]}},{"cve":{"id":"CVE-2026-72668","sourceIdentifier":"security@elastic.co","published":"2026-09-26T21:16:55.540","lastModified":"2026-09-29T04:17:57.373","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Kibana","defaultStatus":"unaffected","versions":[{"version":"9.4.0","lessThanOrEqual":"9.4.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T00:00:00+00:00","id":"CVE-2026-72668","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"references":[{"url":"https://discuss.elastic.co/t/kibana-9-4-7-9-5-0-security-update-esa-2026-85/390678","source":"security@elastic.co"}]}},{"cve":{"id":"CVE-2026-78582","sourceIdentifier":"security@elastic.co","published":"2026-09-26T21:16:55.663","lastModified":"2026-09-28T16:31:47.727","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Kibana","defaultStatus":"unaffected","versions":[{"version":"7.12.0","lessThanOrEqual":"7.17.29","versionType":"semver","status":"affected"},{"version":"8.0.0","lessThanOrEqual":"8.19.21","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.4.6","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:01:06.197371Z","id":"CVE-2026-78582","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-139/390680","source":"security@elastic.co"}]}},{"cve":{"id":"CVE-2026-82294","sourceIdentifier":"security@elastic.co","published":"2026-09-26T21:16:55.783","lastModified":"2026-09-29T18:41:14.000","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.20","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.4.5","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:00:51.354377Z","id":"CVE-2026-82294","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.19.21","matchCriteriaId":"E741C869-ACFA-420B-B1F4-5BC5166A22FD"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.4.6","matchCriteriaId":"E73C9AA0-8BBA-410A-AC54-792E68EC9757"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.3","matchCriteriaId":"9B53D798-705F-469D-B2CC-7B6DD22CC56E"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-21-9-4-6-9-5-3-security-update-esa-2026-170/390681","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-82300","sourceIdentifier":"security@elastic.co","published":"2026-09-26T21:16:55.907","lastModified":"2026-10-01T13:17:10.540","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.21","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.4.6","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:00:36.644819Z","id":"CVE-2026-82300","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.19.22","matchCriteriaId":"C598AA22-4F36-4D09-9C16-187F55825C02"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.4.7","matchCriteriaId":"4410D477-3311-4D1A-B428-401D0CA104C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.4","matchCriteriaId":"D808C786-9949-4B3D-B987-276F6C407C04"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-176/390682","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-94396","sourceIdentifier":"security@elastic.co","published":"2026-09-26T21:16:56.027","lastModified":"2026-09-29T18:42:12.743","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)"}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"9.2.0","lessThanOrEqual":"9.4.6","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:59:26.199053Z","id":"CVE-2026-94396","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.2.0","versionEndExcluding":"9.4.7","matchCriteriaId":"FBB1DE15-8187-4A4B-8454-93474375264F"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.4","matchCriteriaId":"D808C786-9949-4B3D-B987-276F6C407C04"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-4-security-update-esa-2026-182/390686","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-94397","sourceIdentifier":"security@elastic.co","published":"2026-09-26T21:16:56.143","lastModified":"2026-09-29T20:20:00.247","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)"}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.21","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.4.6","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:59:10.741441Z","id":"CVE-2026-94397","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.19.22","matchCriteriaId":"C598AA22-4F36-4D09-9C16-187F55825C02"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.4.7","matchCriteriaId":"4410D477-3311-4D1A-B428-401D0CA104C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.4","matchCriteriaId":"D808C786-9949-4B3D-B987-276F6C407C04"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-183/390687","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-94398","sourceIdentifier":"security@elastic.co","published":"2026-09-26T21:16:56.277","lastModified":"2026-09-29T20:19:32.547","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)"}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"8.12.0","lessThanOrEqual":"8.19.21","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.4.6","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T23:00:17.057160Z","id":"CVE-2026-94398","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.12.0","versionEndExcluding":"8.19.22","matchCriteriaId":"FDC026D5-D355-47A2-B9C1-CA1CE69937F3"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.4.7","matchCriteriaId":"4410D477-3311-4D1A-B428-401D0CA104C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.4","matchCriteriaId":"D808C786-9949-4B3D-B987-276F6C407C04"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-179/390683","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-94399","sourceIdentifier":"security@elastic.co","published":"2026-09-26T21:16:56.393","lastModified":"2026-09-29T20:15:11.523","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)"}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.21","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.4.6","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:59:56.181888Z","id":"CVE-2026-94399","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.19.22","matchCriteriaId":"C598AA22-4F36-4D09-9C16-187F55825C02"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.4.7","matchCriteriaId":"4410D477-3311-4D1A-B428-401D0CA104C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.4","matchCriteriaId":"D808C786-9949-4B3D-B987-276F6C407C04"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-180/390684","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-94400","sourceIdentifier":"security@elastic.co","published":"2026-09-26T21:16:56.513","lastModified":"2026-09-29T20:08:27.480","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)"}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Kibana","defaultStatus":"unaffected","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.21","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.4.6","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:59:41.757778Z","id":"CVE-2026-94400","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.19.22","matchCriteriaId":"C4646200-614E-4F99-B564-94BD3B267B12"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.4.7","matchCriteriaId":"51B034B7-56C9-4DBE-87EC-7B4268C1B426"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.3","matchCriteriaId":"09DBAE82-4348-4189-BFB0-E7D7549FD2D2"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-181/390685","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-94408","sourceIdentifier":"security@elastic.co","published":"2026-09-26T21:16:56.630","lastModified":"2026-10-06T15:31:34.307","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)"}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.21","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.4.6","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:58:53.693615Z","id":"CVE-2026-94408","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.19.22","matchCriteriaId":"C598AA22-4F36-4D09-9C16-187F55825C02"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.4.7","matchCriteriaId":"4410D477-3311-4D1A-B428-401D0CA104C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.3","matchCriteriaId":"9B53D798-705F-469D-B2CC-7B6DD22CC56E"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-3-security-update-esa-2026-184/390688","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100739","sourceIdentifier":"cna@vuldb.com","published":"2026-09-26T22:16:31.207","lastModified":"2026-09-28T17:17:46.340","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T16:53:45.762833Z","id":"CVE-2026-100739","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/vinniboy021-blip/Advisory/blob/main/viewresult-sqli.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-100739","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/914584","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/410596","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/410596/cti","source":"cna@vuldb.com"}]}}]}